4ceae258b423236d0ef8fb8573ebbe5561c9ba9e1731c6e4272cd28e786a935d

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_4f42f998f8cbcbb32e9e284ed138424a_cryptolocker.exe
Size

52KB
MD5

4f42f998f8cbcbb32e9e284ed138424a
SHA1

6987d1731ff866ac357622d14c95c2dff61c1162
SHA256

4ceae258b423236d0ef8fb8573ebbe5561c9ba9e1731c6e4272cd28e786a935d
SHA512

f8b6fbf421e2fdeca74cbbfda8c29397b036c5821a56d09ca11c15e0d6dbbb6f640d7a4da2591c1a520fb6990dbdf46422a858d29d96f718ad34e490a9d9292c
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojaklrt:V6a+pOtEvwDpjq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122f3-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122f3-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2452	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2388	2024-02-19_4f42f998f8cbcbb32e9e284ed138424a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2452	2388	2024-02-19_4f42f998f8cbcbb32e9e284ed138424a_cryptolocker.exe	28
PID 2388 wrote to memory of 2452	2388	2024-02-19_4f42f998f8cbcbb32e9e284ed138424a_cryptolocker.exe	28
PID 2388 wrote to memory of 2452	2388	2024-02-19_4f42f998f8cbcbb32e9e284ed138424a_cryptolocker.exe	28
PID 2388 wrote to memory of 2452	2388	2024-02-19_4f42f998f8cbcbb32e9e284ed138424a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-19_4f42f998f8cbcbb32e9e284ed138424a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_4f42f998f8cbcbb32e9e284ed138424a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
52KB

MD5
6ff68594abad7b5f914bf468a6965371

SHA1
271d4d4e4b1500ce075010aaf361974b4a621949

SHA256
2d29bc97908cc653450756e3c40cdf5b4850e1d7eb3746ce5f9b3e87291ec821

SHA512
541751c3fdfd1b22e81494cc64173d27ee945ab397bad814025c2bffd5f438d8015c91882415c82fef7184a46b7cf7d828e897600c9909d55b22fa84b38b0a47

Download Submit
memory/2388-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2388-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2388-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2452-15-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2452-16-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download