4283dc7d3ccf99bb69e97570133aa7734739f06ecd94c5ac8702b91ed6c7ff03

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 17:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe
Size

67KB
MD5

dca9c23a3566b96a1a88374cc6156506
SHA1

e3829d972438019fa76601c639af841aad6e2987
SHA256

4283dc7d3ccf99bb69e97570133aa7734739f06ecd94c5ac8702b91ed6c7ff03
SHA512

e53a1b602d963cf7f0403f6ba028c684efc207078384c9487cdd5d0e82bb77211f2d3e6dbeb8d76d94a36e9e786b6bb26f993e4f3473d9e519a6750696e97ec7
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKU/:DW60sllyWOtEvwDpjwF85h

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2668-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1992-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1992-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2668-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1992-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2668 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe

pid process

1992 2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2668	asih.exe

pid	process
1992	2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe

description	pid	process	target process
PID 1992 wrote to memory of 2668	1992	2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe	asih.exe
PID 1992 wrote to memory of 2668	1992	2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe	asih.exe
PID 1992 wrote to memory of 2668	1992	2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe	asih.exe
PID 1992 wrote to memory of 2668	1992	2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_dca9c23a3566b96a1a88374cc6156506_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1992

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
68KB

MD5
96a15ab47659da79069f522c0c707b5e

SHA1
e46b33017349013f15ecedcc9b3548c142b83a61

SHA256
ccb97be96d39f80306d7344f4332a980db1c81f0e6cd9d51e0bd8adefab025be

SHA512
aa7fc90a10420b3c02e653c3b6947dd33b3149033df6d5254f89052b934107cd325f80c5730de6b53c1f88463ab75e590fcca951e72db4a4a6866afa6750f57e

Download Submit
memory/1992-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1992-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1992-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1992-5-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1992-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2668-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2668-19-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2668-18-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download