ccf81ffeb05073749e7b3c7270c12da5f1455d937bfe2063b5c1f384d84b414f

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 01:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_8265ef83ac4a63be6c1a5c3e28042e6e_cryptolocker.exe
Size

48KB
MD5

8265ef83ac4a63be6c1a5c3e28042e6e
SHA1

39e94766d5fbfdc84118ac59b4fded5dbefc514a
SHA256

ccf81ffeb05073749e7b3c7270c12da5f1455d937bfe2063b5c1f384d84b414f
SHA512

368959e3e62ffc9c94754dc84186e514f598089a4109203fd117c210553530609e4d3b35dba52b7e5a21dca1bfe43073b8bf0951a72a818bb3e7302437e03d5a
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojakNE:V6a+pOtEvwDpjT

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012247-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012247-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3052	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2880	2024-02-20_8265ef83ac4a63be6c1a5c3e28042e6e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3052	2880	2024-02-20_8265ef83ac4a63be6c1a5c3e28042e6e_cryptolocker.exe	28
PID 2880 wrote to memory of 3052	2880	2024-02-20_8265ef83ac4a63be6c1a5c3e28042e6e_cryptolocker.exe	28
PID 2880 wrote to memory of 3052	2880	2024-02-20_8265ef83ac4a63be6c1a5c3e28042e6e_cryptolocker.exe	28
PID 2880 wrote to memory of 3052	2880	2024-02-20_8265ef83ac4a63be6c1a5c3e28042e6e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-20_8265ef83ac4a63be6c1a5c3e28042e6e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_8265ef83ac4a63be6c1a5c3e28042e6e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
dcff3c0e97698132838b7524d116b496

SHA1
1b7899be70d93e98c0f37d2d55fc99376861873e

SHA256
6bd8069ef07b7f0d9c6d659c686cf841c5cfd460a97b78d53302259a4c847dff

SHA512
e831108cb50f297ced35a23df71a98d110c8946786366b97d4432279166590496825573d660b8fb14fc47ae0154db0c8067bd1c6753e66f705ef7adfce658dff

Download Submit
memory/2880-0-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2880-1-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2880-2-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/3052-16-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3052-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download