53c32df0aa4f168f114874f8b1bdcb0a7892cb4c20db2189e13d9b1ed99c4550

Analysis

max time kernel
149s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 03:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_ac1b58e409d1e38373b10b6c23e5687b_cryptolocker.exe
Size

48KB
MD5

ac1b58e409d1e38373b10b6c23e5687b
SHA1

0d5436295cb5cc30fc6503a0a28a20e0ee1b16c2
SHA256

53c32df0aa4f168f114874f8b1bdcb0a7892cb4c20db2189e13d9b1ed99c4550
SHA512

31cf7436952e658f129d1946414d1a82ebcfb5b6b2377d5e68cdb3b4269b027e3dc2ef40cf7ba3ca589a71453de54b99dd65527f7273e0e8bc48cfd3665b9412
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55id3AMWZGDQ:X6QFElP6n+gJQMOtEvwDpjB0GIWiWLkQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012262-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012262-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2728	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1444	2024-02-20_ac1b58e409d1e38373b10b6c23e5687b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 2728	1444	2024-02-20_ac1b58e409d1e38373b10b6c23e5687b_cryptolocker.exe	28
PID 1444 wrote to memory of 2728	1444	2024-02-20_ac1b58e409d1e38373b10b6c23e5687b_cryptolocker.exe	28
PID 1444 wrote to memory of 2728	1444	2024-02-20_ac1b58e409d1e38373b10b6c23e5687b_cryptolocker.exe	28
PID 1444 wrote to memory of 2728	1444	2024-02-20_ac1b58e409d1e38373b10b6c23e5687b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-20_ac1b58e409d1e38373b10b6c23e5687b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_ac1b58e409d1e38373b10b6c23e5687b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
2492908282696a9c5db93d3cc34a3daa

SHA1
d0558b5a5e2fc308ceda17ae6067862f9c23fc94

SHA256
7c059042e0b000d4882c77678aecbb4e66c02f7f1d27cffa6465d29f134c2bd4

SHA512
51e106a63bbd1b1f8f10edfa4bd9a0875ee1d0badf2bd35213d7f5b9875395212466cda440f50b2c61782959c1066b312689343572d6404566801ee26766b717

Download Submit
memory/1444-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1444-2-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1444-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2728-16-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2728-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download