3b79c893f0b2c417648bcf9d7d2be7a520a5edeffb776e745dff71e3ad8b44c9

Analysis

max time kernel
150s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 13:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe
Size

69KB
MD5

9c1f5722cd94723870bb82e5bbee914c
SHA1

f403061dacd1626a6368ea171ea7a6fe5d6a8cc9
SHA256

3b79c893f0b2c417648bcf9d7d2be7a520a5edeffb776e745dff71e3ad8b44c9
SHA512

6834279e08e718a57d6074f69858a57007fdd4c00c9c97ac3fdcc7fddd91633ab3bbff6ecd30a36079934b0e9d920240e8cab58aebb1b5643f6b5b59468542de
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUH/:DW60sllyWOtEvwDpjwF85h

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2436-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2436-14-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000e000000012247-11.dat	CryptoLocker_rule2
behavioral1/memory/2648-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2436-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2436-14-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000e000000012247-11.dat	CryptoLocker_set1
behavioral1/memory/2648-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2648	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2436	2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2436 wrote to memory of 2648	2436	2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe	28
PID 2436 wrote to memory of 2648	2436	2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe	28
PID 2436 wrote to memory of 2648	2436	2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe	28
PID 2436 wrote to memory of 2648	2436	2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_9c1f5722cd94723870bb82e5bbee914c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
69KB

MD5
6d49f207220729456589484a0743480c

SHA1
9ac8d321f66a1bcf39bce3e3fd9e611e7b8a9740

SHA256
83cdada5de7f1c0d041d9cedc6a2f29990af87a973d95ea6d30d7882b1e9879b

SHA512
57cf38306a9f731d2ea59a1d54bb47e1df626aa0d6f77a8ec4b1af3874f6e418ef3785b4c45290cf292d376306044717adf80387179372b26c785e3ef8e674b5

Download Submit
memory/2436-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2436-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2436-3-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2436-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2436-14-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2648-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2648-18-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2648-23-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download