1249956bba0b2f8a860f3591a09092d488c2a7df38e49ed9de207ce3a8d38820

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 07:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_512625a5ead1e5817fd8db3dfc87a75d_cryptolocker.exe
Size

36KB
MD5

512625a5ead1e5817fd8db3dfc87a75d
SHA1

de3c5d554c27470ebfe01a9f6387817290c53ca2
SHA256

1249956bba0b2f8a860f3591a09092d488c2a7df38e49ed9de207ce3a8d38820
SHA512

84834de4a5ccc753dba4da88b37e638228996c6d8275c3edc497c5adc028717355ea0a60a87f0fa92c7850d65153114831a9c73a5709714a4007ef4fc6bd6d3b
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFCpV:X6QFElP6n+gJQMOtEvwDpjBmzDUpV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012261-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012261-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2876	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3000	2024-02-12_512625a5ead1e5817fd8db3dfc87a75d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2876	3000	2024-02-12_512625a5ead1e5817fd8db3dfc87a75d_cryptolocker.exe	28
PID 3000 wrote to memory of 2876	3000	2024-02-12_512625a5ead1e5817fd8db3dfc87a75d_cryptolocker.exe	28
PID 3000 wrote to memory of 2876	3000	2024-02-12_512625a5ead1e5817fd8db3dfc87a75d_cryptolocker.exe	28
PID 3000 wrote to memory of 2876	3000	2024-02-12_512625a5ead1e5817fd8db3dfc87a75d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-12_512625a5ead1e5817fd8db3dfc87a75d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_512625a5ead1e5817fd8db3dfc87a75d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
c490d086bf5cd72fe49a7c0083ddf613

SHA1
94d6d5e42d201d1773616961d460b695d105ce84

SHA256
48d8e309a21bfe0c500946fdfbe8c79e201ad154c0a8ea66cd085733359f7efc

SHA512
3dbb224855991100a821daededf66f150ead3d727817a818885727d8d942f4e20de68e1abe73a4eb2459532e94b7ababbafa7bdef2d9841d7fa23905ef0a1328

Download Submit
memory/2876-15-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/2876-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3000-0-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/3000-2-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/3000-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download