41108edf789619115af29264e2749c89e859bd69fea5902ab53374d86c917451

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04/02/2024, 01:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-04_531032fc6faefc08978ab4cf256096c4_cryptolocker.exe
Size

83KB
MD5

531032fc6faefc08978ab4cf256096c4
SHA1

0f6eca90d31e5d7506d46424fb01387ae68d2df1
SHA256

41108edf789619115af29264e2749c89e859bd69fea5902ab53374d86c917451
SHA512

0cc4cc1cd7607ae4e0ef45be42fa08f7bca1586f6280155462fa2bb89255b4638ccefbe8fd973b9dd9b6f44dfc382f1a4f3af236e692bf943f3c07834db7842a
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNlVSL8T:V6a+pOtEvwDpjvpV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001225c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001225c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1968	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1632	2024-02-04_531032fc6faefc08978ab4cf256096c4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1968	1632	2024-02-04_531032fc6faefc08978ab4cf256096c4_cryptolocker.exe	28
PID 1632 wrote to memory of 1968	1632	2024-02-04_531032fc6faefc08978ab4cf256096c4_cryptolocker.exe	28
PID 1632 wrote to memory of 1968	1632	2024-02-04_531032fc6faefc08978ab4cf256096c4_cryptolocker.exe	28
PID 1632 wrote to memory of 1968	1632	2024-02-04_531032fc6faefc08978ab4cf256096c4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-04_531032fc6faefc08978ab4cf256096c4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_531032fc6faefc08978ab4cf256096c4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
83KB

MD5
22507ef38e441b07b311b685f12f4c06

SHA1
1c88d6e22020df83cb028705397ed227c9f6c999

SHA256
d40267844422c1aa6d50f694b3c66c2eeaf81fd59e852b6fa3afa3463dfbbe38

SHA512
235a91d8d50c8a56607f9f8bc0698c12615d9b42e78409fc2d92fd4a6edb1444cc49c26416540109d0638e745eb69a523b46744deada3eaca970e706c7d5d5f3

Download Submit
memory/1632-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1632-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1632-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1968-16-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1968-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download