c7287f724ef1ae1aee6663ec78fddd55149731521fbe9c48fb86c77997ecf703

Analysis

max time kernel
150s
max time network
155s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
19/02/2024, 17:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_888b1d8bb04f4f7b891fe2a55fe9705f_cryptolocker.exe
Size

69KB
MD5

888b1d8bb04f4f7b891fe2a55fe9705f
SHA1

774362f6750c11a5cadd0dc67ebedd5d07470bbe
SHA256

c7287f724ef1ae1aee6663ec78fddd55149731521fbe9c48fb86c77997ecf703
SHA512

803978c46abdc79673844ed422305a289ac8cdce0e00967976b9febc75fa6cfe7a138100b144508c201ebbb7b0738e527728aa5ab86469a15c5b248717e61f26
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNZOX:DW60sllyWOtEvwDpjwF85o

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1744-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012252-11.dat	CryptoLocker_rule2
behavioral1/memory/1744-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2408-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1744-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012252-11.dat	CryptoLocker_set1
behavioral1/memory/1744-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2408-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2408	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1744	2024-02-19_888b1d8bb04f4f7b891fe2a55fe9705f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 2408	1744	2024-02-19_888b1d8bb04f4f7b891fe2a55fe9705f_cryptolocker.exe	28
PID 1744 wrote to memory of 2408	1744	2024-02-19_888b1d8bb04f4f7b891fe2a55fe9705f_cryptolocker.exe	28
PID 1744 wrote to memory of 2408	1744	2024-02-19_888b1d8bb04f4f7b891fe2a55fe9705f_cryptolocker.exe	28
PID 1744 wrote to memory of 2408	1744	2024-02-19_888b1d8bb04f4f7b891fe2a55fe9705f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-19_888b1d8bb04f4f7b891fe2a55fe9705f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_888b1d8bb04f4f7b891fe2a55fe9705f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
69KB

MD5
e7eeab688e2282e23214c77b7d19f6fd

SHA1
5d2f8adfab8fdbaadcebd70553976d29793930f9

SHA256
26749a9b0a1745868565f1454292eb1805663df790fc250411ec5685c0d405d1

SHA512
54405303b6ead9caf02d58eecf7010573eb54f07316a970dd3d6a36eb83e5d911c885c06b82b79a56c037b672545d88baf6514f19de5b521c6a9c39c1e6b7921

Download Submit
memory/1744-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1744-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1744-2-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/1744-3-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1744-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2408-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2408-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2408-20-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download