58c047042f0e1d3fee5f89e745d19469fd9140fcffdfac00d10565adade14b1a

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 11:22

Target

2024-02-03_151c5f5e367462bfcdb0aa578a0f813f_cryptolocker.exe
Size

48KB
MD5

151c5f5e367462bfcdb0aa578a0f813f
SHA1

3d1e3f902bf0aa31a2941e7740c3228091934c7e
SHA256

58c047042f0e1d3fee5f89e745d19469fd9140fcffdfac00d10565adade14b1a
SHA512

6dd2310b9caa8e6efe3cd7b0d1212fbfa75896e68a8be1824ff21f3a80b454902f253f23f2d3ae2326d98903f550d68939ee2987aa945fea9fa816e6bcd1956b
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaToP:X6QFElP6n+gJBMOtEvwDpjBtEhP

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000014439-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000014439-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2080	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2264	2024-02-03_151c5f5e367462bfcdb0aa578a0f813f_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 2080	2264	2024-02-03_151c5f5e367462bfcdb0aa578a0f813f_cryptolocker.exe	28
PID 2264 wrote to memory of 2080	2264	2024-02-03_151c5f5e367462bfcdb0aa578a0f813f_cryptolocker.exe	28
PID 2264 wrote to memory of 2080	2264	2024-02-03_151c5f5e367462bfcdb0aa578a0f813f_cryptolocker.exe	28
PID 2264 wrote to memory of 2080	2264	2024-02-03_151c5f5e367462bfcdb0aa578a0f813f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-03_151c5f5e367462bfcdb0aa578a0f813f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_151c5f5e367462bfcdb0aa578a0f813f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2080

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
1e519b5939d37184fbdc983ee295eb5b

SHA1
52cc801f3dc17a9efc6619db08f430fc5517e85e

SHA256
5e3d497b13cae7f94babf01b8565bce64160a8cd21ead397a93b93e3e8daafde

SHA512
bb36570022550b7295e985fdab3bca5d5eb86dceb9c05e2cf48fa08869a711b3c592e9fe6841c6568d2b5dfa76f92ce9110f324750877a6c6b05298f2d26ead8

Download Submit
memory/2080-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2080-18-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2264-0-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2264-1-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2264-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download