9b3f1473670f758a26fded1e5989a4fba2821f1db1f9af694668f02a22b2575d

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe
Size

61KB
MD5

7d6a283680d30a921b73f2f622932a0e
SHA1

38a4e76f41aa0390fc427a33be6c2243b25ccbbe
SHA256

9b3f1473670f758a26fded1e5989a4fba2821f1db1f9af694668f02a22b2575d
SHA512

572f06cf973d3fa97ffe606233d71e49b3e28b2bd1bd9917faf5f53c22671c9b2cfcd90deea8c58d2916d12d778ad24d35d004ffceb234dcc8550dcaab2d86a2
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLZ/xEW:X6a+SOtEvwDpjBrOv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2880 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe

pid process

1160 2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2880	asih.exe

pid	process
1160	2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe

description	pid	process	target process
PID 1160 wrote to memory of 2880	1160	2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe	asih.exe
PID 1160 wrote to memory of 2880	1160	2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe	asih.exe
PID 1160 wrote to memory of 2880	1160	2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe	asih.exe
PID 1160 wrote to memory of 2880	1160	2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_7d6a283680d30a921b73f2f622932a0e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1160

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
61KB

MD5
8868bcfa54bed8bf7a70cae72ffc51f0

SHA1
ee239eb5338fb45b933a441847d6a80d117125a4

SHA256
694ace19369c8879af19d2fd44e33c4aa885201e913d797f63641bcb824d3ec6

SHA512
9be3f9a0a5e7ccd21f4d6ccbe7bbde1287ce80aa77d295e01b03a6d59a88cb595dda1c952c392d9e69e22a34081b62c076d9846fd42579548365409d2115abcd

Download Submit
memory/1160-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1160-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1160-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2880-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2880-17-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download