64d4276e55deda469a8031551a107535119aff62d4cdf6b6e105d9e51393d679

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 07:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-03_87cd6668cbfc65fe8ad1a1027b1ba829_cryptolocker.exe
Size

53KB
MD5

87cd6668cbfc65fe8ad1a1027b1ba829
SHA1

af5bbc59605628e13acb702ae99b514276c4dab9
SHA256

64d4276e55deda469a8031551a107535119aff62d4cdf6b6e105d9e51393d679
SHA512

2b6b2c44b2d6f527eaa5a8a573640971f23d7f00e5acb4b2474cb038ce49cc04df885a54eab2c1f909e93aae8742af4940cfe33541d795f2ea5c0a475460aa00
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTiSfQaV2L0zNG:X6QFElP6n+gJBMOtEvwDpjBtE1yIL/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001223f-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001223f-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2396	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	2024-02-03_87cd6668cbfc65fe8ad1a1027b1ba829_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2396	2252	2024-02-03_87cd6668cbfc65fe8ad1a1027b1ba829_cryptolocker.exe	28
PID 2252 wrote to memory of 2396	2252	2024-02-03_87cd6668cbfc65fe8ad1a1027b1ba829_cryptolocker.exe	28
PID 2252 wrote to memory of 2396	2252	2024-02-03_87cd6668cbfc65fe8ad1a1027b1ba829_cryptolocker.exe	28
PID 2252 wrote to memory of 2396	2252	2024-02-03_87cd6668cbfc65fe8ad1a1027b1ba829_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-03_87cd6668cbfc65fe8ad1a1027b1ba829_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_87cd6668cbfc65fe8ad1a1027b1ba829_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
46dcdabb9edb11ce5a9ee2b42dc789e0

SHA1
fd18b3f027f8ae3e99357bda324f44fb9f8652a9

SHA256
46e40ed2ed2df62bd99ce1b28f35f970a6b050851b707881af085e30bb9ce61b

SHA512
9c752cca9d73ca22222bccc9efeb7fa34e8073e0576553095c5a73f5044c2b339ea9055cef65ad4403dd1a4d484dc15d04f2293a92ac9fc8d7eb959f1f5c027d

Download Submit
memory/2252-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2252-1-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2252-2-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2396-15-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2396-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download