220a91f84faf318735287bccf849c08b8ef6196ba709416355f1ef0d51254e00

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 12:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_89d9b5101540807903ad39256ab450b1_cryptolocker.exe
Size

38KB
MD5

89d9b5101540807903ad39256ab450b1
SHA1

5488124a10bf14e708fdb9d8e49e3f24807d3df5
SHA256

220a91f84faf318735287bccf849c08b8ef6196ba709416355f1ef0d51254e00
SHA512

3b70d5ed0f44edb04c777755269fbe3f49b546c93036f1603d029a874feac28672cd634464d5b587c5bc3a3313a0cad31c75c0a34a9b6575a26b29076d0a940f
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL9B:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL7

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral1/memory/1224-8-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000012251-11.dat	CryptoLocker_rule2
behavioral1/memory/1224-13-0x0000000001DD0000-0x0000000001DDB000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral1/memory/1224-8-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b000000012251-11.dat	CryptoLocker_set1
behavioral1/memory/1224-13-0x0000000001DD0000-0x0000000001DDB000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2820	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1224	2024-02-14_89d9b5101540807903ad39256ab450b1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1224 wrote to memory of 2820	1224	2024-02-14_89d9b5101540807903ad39256ab450b1_cryptolocker.exe	28
PID 1224 wrote to memory of 2820	1224	2024-02-14_89d9b5101540807903ad39256ab450b1_cryptolocker.exe	28
PID 1224 wrote to memory of 2820	1224	2024-02-14_89d9b5101540807903ad39256ab450b1_cryptolocker.exe	28
PID 1224 wrote to memory of 2820	1224	2024-02-14_89d9b5101540807903ad39256ab450b1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_89d9b5101540807903ad39256ab450b1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_89d9b5101540807903ad39256ab450b1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1224
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
0ddcdabf17b0ee18dfb239d362c1f74d

SHA1
0d5c91affb62eb60143deae8bcb8ca62105e5998

SHA256
686576284d5722d86321fb8c2ce0f061343996e7e48e01cd273653802985397e

SHA512
28006889e1b70e12e8d9f69a8039289b83c54210b780b862749997af8c5163343f7f3afaae369f4b99f92da7eb610f57a1846ede06b1f4f7ebed196fe05e746d

Download Submit
memory/1224-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1224-8-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1224-1-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1224-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1224-13-0x0000000001DD0000-0x0000000001DDB000-memory.dmp

Filesize
44KB

Download
memory/2820-17-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2820-24-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download