e3acd8754fd0b689e6ae0a1c218fc65681a08d6bd281996f9f5f03ed1ca861ed

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 17:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe
Size

51KB
MD5

717f4db2275768042bf9974dcf041612
SHA1

ad992b89c306e4520dcf33bf9b64af6c68bfa27c
SHA256

e3acd8754fd0b689e6ae0a1c218fc65681a08d6bd281996f9f5f03ed1ca861ed
SHA512

4b08fc0d94ae5247f763c302ffaf18b87fbc1b9e2cf9deda14228133231363af970dcad2623432df430dfdd08e74f8932e6788c105eb0f928b56a239500a5d55
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojaklx:V6a+pOtEvwDpjS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2648 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe

pid process

2624 2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2648	asih.exe

pid	process
2624	2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe

description	pid	process	target process
PID 2624 wrote to memory of 2648	2624	2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe	asih.exe
PID 2624 wrote to memory of 2648	2624	2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe	asih.exe
PID 2624 wrote to memory of 2648	2624	2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe	asih.exe
PID 2624 wrote to memory of 2648	2624	2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_717f4db2275768042bf9974dcf041612_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
52KB

MD5
785373c6e17c7289d22accc2d28fbf7f

SHA1
f7e5977daae3611a70d9c3875e2fd774783dbda1

SHA256
48acf5d66bea20157b517452a1aa3de858d1ab450d3fcabb1c7d5c9c44650fb8

SHA512
3c4e612d5d4f6e33db9db23b39afdfa2036b51da28c877bb7e6b905bce52d2b3ab8faa7c4372b17c015a1a51787c6c56e353436afb3268302ed07cac4c48df13

Download Submit
memory/2624-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2624-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2624-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2648-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2648-16-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download