d719255c83d5a30a7e3b0386ef7a8feb5dd5c6cc54a2d4786d239ff44fe031da

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 10:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_fef2ff5891dc950b0a483f0242eb51a2_cryptolocker.exe
Size

38KB
MD5

fef2ff5891dc950b0a483f0242eb51a2
SHA1

6d7eb9b6b002b67cfd558378478591dcdd8fa623
SHA256

d719255c83d5a30a7e3b0386ef7a8feb5dd5c6cc54a2d4786d239ff44fe031da
SHA512

df0cf69fcdd355202bfc8de7fb949265aff1871a1c492b54ea95a77b8c85410eef419ddbd9a7f5f189b8142f8e7ecdcc6ce21c6376ae0e87289b97eee5ce9370
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLx:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLx

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2152-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000012256-11.dat	CryptoLocker_rule2
behavioral1/memory/2152-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2520-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2152-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000012256-11.dat	CryptoLocker_set1
behavioral1/memory/2152-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2520-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2520	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2152	2024-02-23_fef2ff5891dc950b0a483f0242eb51a2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 2520	2152	2024-02-23_fef2ff5891dc950b0a483f0242eb51a2_cryptolocker.exe	28
PID 2152 wrote to memory of 2520	2152	2024-02-23_fef2ff5891dc950b0a483f0242eb51a2_cryptolocker.exe	28
PID 2152 wrote to memory of 2520	2152	2024-02-23_fef2ff5891dc950b0a483f0242eb51a2_cryptolocker.exe	28
PID 2152 wrote to memory of 2520	2152	2024-02-23_fef2ff5891dc950b0a483f0242eb51a2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-23_fef2ff5891dc950b0a483f0242eb51a2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_fef2ff5891dc950b0a483f0242eb51a2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
582bded1166b11a7e5e87ed04f03074c

SHA1
0ca5251298405e3558e1efccd7a401f3e7ce7e5c

SHA256
91a850182a46af784d93c66b0b5185722429db6f4f21bf5456256014404fb77d

SHA512
7d247cf592d978275dfeeb1bbc98c08914dc3a3c60580933c9fe5f0d90a0473dbcccfd609ad508a576f9cd6c50fd2fc799d04b8a270b369efef1ebd87b148e2b

Download Submit
memory/2152-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2152-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2152-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2152-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2152-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2152-14-0x0000000001EB0000-0x0000000001EBB000-memory.dmp

Filesize
44KB

Download
memory/2520-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2520-19-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2520-21-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download