7c540ef0ec0564a7614caf7bd92450d32a9ea7b4d64d12b603dc2303b4f91e87

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 07:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_c63ac3ff60ccecf6b3e0eddde6d03d14_cryptolocker.exe
Size

49KB
MD5

c63ac3ff60ccecf6b3e0eddde6d03d14
SHA1

82841701d9f1f73b5fc16ed9de1dfd7d0c7beb57
SHA256

7c540ef0ec0564a7614caf7bd92450d32a9ea7b4d64d12b603dc2303b4f91e87
SHA512

37fdb6a091d79667fb463d9611e5a7adb99418febeae4b6c38c1292773465e20f02bb967c1319213405670f4385a15206ada129767357be3e25ca24fd668ca1b
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakN1:V6a+pOtEvwDpjO

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012243-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012243-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2332	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2656	2024-02-14_c63ac3ff60ccecf6b3e0eddde6d03d14_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2656 wrote to memory of 2332	2656	2024-02-14_c63ac3ff60ccecf6b3e0eddde6d03d14_cryptolocker.exe	28
PID 2656 wrote to memory of 2332	2656	2024-02-14_c63ac3ff60ccecf6b3e0eddde6d03d14_cryptolocker.exe	28
PID 2656 wrote to memory of 2332	2656	2024-02-14_c63ac3ff60ccecf6b3e0eddde6d03d14_cryptolocker.exe	28
PID 2656 wrote to memory of 2332	2656	2024-02-14_c63ac3ff60ccecf6b3e0eddde6d03d14_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_c63ac3ff60ccecf6b3e0eddde6d03d14_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_c63ac3ff60ccecf6b3e0eddde6d03d14_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2656
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
09420d87dd132d1f1b5d133b031e6dc4

SHA1
b8705d65715ca228a0e572be2ae0539cb879b817

SHA256
9b95520e956ec39115c75159acac5fcafb6154c2b26279cd17ee1d1c0aad1ae6

SHA512
bebb2503dbef138395a7f55a89dd3cfc175197bf4697761dff0cc4f37ac264a4b8f8f480e1afe8be48e23e345aee135b6420129f77aa4f51c0f524a80e9f1b29

Download Submit
memory/2332-16-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2332-15-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2656-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2656-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2656-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download