040e3b62b86ff651b3be01e659e5a75850daf16f6628336b40449a44289d0d2d

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-21_8f611247787fb57b7988bbbb05a90470_cryptolocker.exe
Size

51KB
MD5

8f611247787fb57b7988bbbb05a90470
SHA1

60dcd3185ddbe4b346798382d5e9dd688c3390f4
SHA256

040e3b62b86ff651b3be01e659e5a75850daf16f6628336b40449a44289d0d2d
SHA512

a750bc6d2b400e21dd0234cd461ac036a67ada108f8fa237608d31d6ffc414eab00c30c3fcc1066c906f8f5fad09f3ef1ffb5f4346c64442d89cad78b6d40eee
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRk:79mqyNhQMOtEvwDpjBxe8TpXRk

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1940-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a000000012243-11.dat	CryptoLocker_rule2
behavioral1/memory/1940-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2112-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1940-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000a000000012243-11.dat	CryptoLocker_set1
behavioral1/memory/1940-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2112-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2112	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1940	2024-02-21_8f611247787fb57b7988bbbb05a90470_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2112	1940	2024-02-21_8f611247787fb57b7988bbbb05a90470_cryptolocker.exe	28
PID 1940 wrote to memory of 2112	1940	2024-02-21_8f611247787fb57b7988bbbb05a90470_cryptolocker.exe	28
PID 1940 wrote to memory of 2112	1940	2024-02-21_8f611247787fb57b7988bbbb05a90470_cryptolocker.exe	28
PID 1940 wrote to memory of 2112	1940	2024-02-21_8f611247787fb57b7988bbbb05a90470_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-21_8f611247787fb57b7988bbbb05a90470_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-21_8f611247787fb57b7988bbbb05a90470_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2112

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
51KB

MD5
2198fffc95da56f4314320cbd6da934b

SHA1
f66dd57f10db5fc5f168c203ca4f9a64cd994e57

SHA256
7fa1609a731a2876c916ca55681b4a98b434677c087bd4632b9f992afa7e9317

SHA512
bb43bb502a6f72fdd2fa8af498ab9d017c19502c37964d63f1517fb3771af563c83a1bb384479bec57a71b9b886a32c4529e519538ac15a289be99f25992661e

Download Submit
memory/1940-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1940-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1940-3-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1940-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1940-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2112-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2112-18-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download