1cc17d55a4b4c23ad7885e3c33206a00a719a57b8d95aa0a5b22ca3028e84af9

Analysis

max time kernel
170s
max time network
191s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28/02/2024, 21:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_9313e15aefdd9035b632ccf9c4130725_cryptolocker.exe
Size

37KB
MD5

9313e15aefdd9035b632ccf9c4130725
SHA1

e33942d1ebd1ac26d05ac23f4f9ec9ddb3977ea2
SHA256

1cc17d55a4b4c23ad7885e3c33206a00a719a57b8d95aa0a5b22ca3028e84af9
SHA512

737148559dc7665d693cea335007a264e89dcab41ccae27bca212531cdca13b58e1eb906f771b29ac6d97a7c956ff830af21c98dd64019c9d72e967c7eece735
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5ax6A:V6QFElP6n+gMQMOtEvwDpjyaYaP

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014b86-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014b86-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2572	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2872	2024-02-28_9313e15aefdd9035b632ccf9c4130725_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2572	2872	2024-02-28_9313e15aefdd9035b632ccf9c4130725_cryptolocker.exe	29
PID 2872 wrote to memory of 2572	2872	2024-02-28_9313e15aefdd9035b632ccf9c4130725_cryptolocker.exe	29
PID 2872 wrote to memory of 2572	2872	2024-02-28_9313e15aefdd9035b632ccf9c4130725_cryptolocker.exe	29
PID 2872 wrote to memory of 2572	2872	2024-02-28_9313e15aefdd9035b632ccf9c4130725_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-02-28_9313e15aefdd9035b632ccf9c4130725_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_9313e15aefdd9035b632ccf9c4130725_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
c07dbf1bc4bb7b8c2bb7b1377f00f59d

SHA1
d18806f9204116b3b70ddc555ba5b602c3a7bbb4

SHA256
4905b9ffc3ac4a0964fb4d3987683a31d4d6ebefa47abbb04dfee1a897111dad

SHA512
ad62b50488ac06863558d1d8eb24baeb227f66532c035e673d3e92d8d73f9e4f0226d8706aabe056cd6f2d730d08c7be0f0f1384ca8f6b6c93602f51af86087d

Download Submit
memory/2572-15-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2572-16-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2872-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2872-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2872-1-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download