78a4a570b66fc7c53ef6d33159c4ae9f8e256cfeac8a5719175640e71f664317

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/02/2024, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_07592fa4901df7b5314edfe133bba2ee_cryptolocker.exe
Size

54KB
MD5

07592fa4901df7b5314edfe133bba2ee
SHA1

3f386b16428e42a28f729047d084893e6654cc6a
SHA256

78a4a570b66fc7c53ef6d33159c4ae9f8e256cfeac8a5719175640e71f664317
SHA512

1a358b9bd7555b05033b4716c69aeb65e135fb4047ff27e11ad13d4ec2099f185d9d4c6a35ae3dd6ce6c82ccc11e867e107922c1510d1a25baa19b9d9a900a18
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTiSfQaV2LJp:X6QFElP6n+gJBMOtEvwDpjBtE1yILJp

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012246-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012246-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2200	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2256	2024-02-24_07592fa4901df7b5314edfe133bba2ee_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2200	2256	2024-02-24_07592fa4901df7b5314edfe133bba2ee_cryptolocker.exe	28
PID 2256 wrote to memory of 2200	2256	2024-02-24_07592fa4901df7b5314edfe133bba2ee_cryptolocker.exe	28
PID 2256 wrote to memory of 2200	2256	2024-02-24_07592fa4901df7b5314edfe133bba2ee_cryptolocker.exe	28
PID 2256 wrote to memory of 2200	2256	2024-02-24_07592fa4901df7b5314edfe133bba2ee_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-24_07592fa4901df7b5314edfe133bba2ee_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_07592fa4901df7b5314edfe133bba2ee_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
54KB

MD5
2a647e8ee0d4c1d73f47517eae64b42a

SHA1
8a62c5b40ec78e306c1dfbfac811242fc5c943d2

SHA256
ef9b3addfd96d2c7e2ad32837824fce4bc592718b4c4ffca180f060d143411e2

SHA512
31e8555b62754ad0b84a64283a6126b68d779d0d94b21e7ed82c8692db79d5c19cc0bd5ab06a8f492c3ee9033fd08b978bb7ebe3ce516a293eaedb5d973c8950

Download Submit
memory/2200-15-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2200-22-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2256-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2256-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2256-5-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download