Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12-02-2024 19:57
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe
-
Size
38KB
-
MD5
4b98a8803e5adb9861866f14e1e5aaf7
-
SHA1
4f75c4ae9a77c1086dc55918588d39e8a8bcdf77
-
SHA256
f0317d747af2d685d484eaf56cf7d21aa677993be6c9a5066fae7cea87bee01e
-
SHA512
709907263e35d35ea6bcc99d7d19bb02a86c127c37f1607f869fb6fd62ba9d8aff5a6075760d731c79d1dcfe3a214e230efe0357dffb9e2ffae021fedfa6cdce
-
SSDEEP
768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HW1p:X6QFElP6n+gJQMOtEvwDpjBsYWr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 2448 asih.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exepid process 2292 2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exedescription pid process target process PID 2292 wrote to memory of 2448 2292 2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe asih.exe PID 2292 wrote to memory of 2448 2292 2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe asih.exe PID 2292 wrote to memory of 2448 2292 2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe asih.exe PID 2292 wrote to memory of 2448 2292 2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_4b98a8803e5adb9861866f14e1e5aaf7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\asih.exeFilesize
38KB
MD5c98fcfc8df8a8de5b6c389faee688570
SHA1db5409cf5c8519586c23119bc0cb2fdd51358f69
SHA256d28947064eadc9445ca51a494aa3bd011172072e97fdcb287b5ad634393e6791
SHA512e72b8df593b4819f47d508bcaff9c8e301bbc03b843307530c5716fd75df7ed86d14943fef1f420e2eb1721159b0ee0f1b4fff2739ec850446f87b1a15ae7b7b
-
memory/2292-0-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB
-
memory/2292-1-0x00000000004E0000-0x00000000004E6000-memory.dmpFilesize
24KB
-
memory/2292-4-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB
-
memory/2448-15-0x00000000003B0000-0x00000000003B6000-memory.dmpFilesize
24KB
-
memory/2448-16-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB