9480b7f8e6e63d43aaabe9bd3df0a1b1bae8347b3b71bf108eeaff9e25640d92

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
13-02-2024 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-13_49ff6a15bbd4cb7b272acca1dcc174d4_cryptolocker.exe
Size

94KB
MD5

49ff6a15bbd4cb7b272acca1dcc174d4
SHA1

487296117d05b6ac1273d64cc85284c717b2acad
SHA256

9480b7f8e6e63d43aaabe9bd3df0a1b1bae8347b3b71bf108eeaff9e25640d92
SHA512

aee0b19d5f94834fd1be25b84297eebdd640e8ced52b8b4090bec3b93de14791c359d5dcc5d655cd489b5efa20f87a8e3752b0b72a193a2b03b0ee75a5ddd1a8
SSDEEP

1536:Z6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNC4w8:Z6a+pOtEvwDpjtzt

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001225b-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a00000001225b-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2680	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2504	2024-02-13_49ff6a15bbd4cb7b272acca1dcc174d4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2680	2504	2024-02-13_49ff6a15bbd4cb7b272acca1dcc174d4_cryptolocker.exe	28
PID 2504 wrote to memory of 2680	2504	2024-02-13_49ff6a15bbd4cb7b272acca1dcc174d4_cryptolocker.exe	28
PID 2504 wrote to memory of 2680	2504	2024-02-13_49ff6a15bbd4cb7b272acca1dcc174d4_cryptolocker.exe	28
PID 2504 wrote to memory of 2680	2504	2024-02-13_49ff6a15bbd4cb7b272acca1dcc174d4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-13_49ff6a15bbd4cb7b272acca1dcc174d4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_49ff6a15bbd4cb7b272acca1dcc174d4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
94KB

MD5
f616127caa9d13a32d58fadb28217263

SHA1
5c5c682cabc312f31879c8978234dd14ddff9982

SHA256
3118e8109629228bf3e4a2b29ac2b0183241b0b542f8c5e628c74570c6ca611a

SHA512
1ec94abf38e466ba1150a17f69ee34201d113ee4e76d824861a7af95d2a57bc311b8d6166a2f6bb68836d6647a78db44f3901b0b6496190913116b945f48ab09

Download Submit
memory/2504-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2504-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2504-3-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2680-15-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2680-19-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download