2e49310e051f7581ae841f210f74cd50ccc805323da1bdcc61757c292454ed11

Analysis

max time kernel
132s
max time network
141s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 08:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_b876c5ef3d138b4ef8c9b2f8b9b0bef7_cryptolocker.exe
Size

71KB
MD5

b876c5ef3d138b4ef8c9b2f8b9b0bef7
SHA1

7dc3fec8a924bec4c609641470a8a765cd081c75
SHA256

2e49310e051f7581ae841f210f74cd50ccc805323da1bdcc61757c292454ed11
SHA512

c0dfd100c049ca68ec555e7fb2947df84d21386f2603410b8c296f6c7bc0810ea19f08c9a8f948080c49aad0b92299c2c3d8ab78164b5e8cc68856393f2df970
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHsm:X6a+SOtEvwDpjBZYvQd21

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012252-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012252-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2624	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1704	2024-02-19_b876c5ef3d138b4ef8c9b2f8b9b0bef7_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2624	1704	2024-02-19_b876c5ef3d138b4ef8c9b2f8b9b0bef7_cryptolocker.exe	28
PID 1704 wrote to memory of 2624	1704	2024-02-19_b876c5ef3d138b4ef8c9b2f8b9b0bef7_cryptolocker.exe	28
PID 1704 wrote to memory of 2624	1704	2024-02-19_b876c5ef3d138b4ef8c9b2f8b9b0bef7_cryptolocker.exe	28
PID 1704 wrote to memory of 2624	1704	2024-02-19_b876c5ef3d138b4ef8c9b2f8b9b0bef7_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-19_b876c5ef3d138b4ef8c9b2f8b9b0bef7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_b876c5ef3d138b4ef8c9b2f8b9b0bef7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
71KB

MD5
01fc4dc14741048e2989f1d63150fc51

SHA1
f9df8c582c7ce81d6ab438e3b05776b93ea47b7a

SHA256
6583334076a5bd094e9ce16dc8fdf346f5c292a4291bd0dcdf880a1d6562ce37

SHA512
dbea9ddcb04ff3f2a1ce01a7ed8d740b1535aa8118f0978c7eae088614d2260d8041b9664f8ddd4295110e4ab20aae0dc4bb4ac7e3eb1ceac0c00712380b914e

Download Submit
memory/1704-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1704-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1704-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2624-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2624-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download