fc6d7d8d90b7692c2b9ac0b414c566158d30aec1f93aaa6631c588f1493ac7d4

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_08fb537b30bf1480d117cb483811f13f_cryptolocker.exe
Size

99KB
MD5

08fb537b30bf1480d117cb483811f13f
SHA1

e7f375f273d44020e0fcef19f3d69214c0aa6a3d
SHA256

fc6d7d8d90b7692c2b9ac0b414c566158d30aec1f93aaa6631c588f1493ac7d4
SHA512

3c81b209fc0e2afcdef91d147066635738eda366629066a44cd9c65bc5ade3c514cf1d47ceff96f52ac89eb402adb0b203a5a43e6f4d32a424d4f895d5f4c0c4
SSDEEP

1536:26QFElP6n+gBQMOtEvwDpjQGYQbN/PKwNCWwAF:26a+2OtEvwDpjtz5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122db-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122db-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2716	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1280	2024-02-21_08fb537b30bf1480d117cb483811f13f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 2716	1280	2024-02-21_08fb537b30bf1480d117cb483811f13f_cryptolocker.exe	28
PID 1280 wrote to memory of 2716	1280	2024-02-21_08fb537b30bf1480d117cb483811f13f_cryptolocker.exe	28
PID 1280 wrote to memory of 2716	1280	2024-02-21_08fb537b30bf1480d117cb483811f13f_cryptolocker.exe	28
PID 1280 wrote to memory of 2716	1280	2024-02-21_08fb537b30bf1480d117cb483811f13f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_08fb537b30bf1480d117cb483811f13f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_08fb537b30bf1480d117cb483811f13f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
99KB

MD5
5f493082df51dd692ab52c024af8a35c

SHA1
b45280098e40310006b983659351435c93091e5e

SHA256
a04ea54fd9f89782dac0e9ace5da21f8d2faf0082301df2ce0179e311d23352d

SHA512
21405f5c0caa1a80693c8c02499bd73ed7a0f352803c72ef3bad6b863cc256d226637f1bd9aee8e4472e8373661df342c2dbe7cfb9aad601137a4dcd50f1d6af

Download Submit
memory/1280-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1280-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1280-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2716-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2716-22-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download