608de2eab27eb24220653b3d8936925e971f26b2810b3ad63766e78d93cc34ba

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 07:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_631064afef31926c9f49708c6881e0e0_cryptolocker.exe
Size

130KB
MD5

631064afef31926c9f49708c6881e0e0
SHA1

5edc6ea21582d7692c98a26b8c1bc1d9457717b6
SHA256

608de2eab27eb24220653b3d8936925e971f26b2810b3ad63766e78d93cc34ba
SHA512

7840d48469e3563b959b67286025db087c4cf9254ed4cb1fa36013f3034d473c02a48449b22789b9984037863b9be62e6ab33b70e65e10f03e32456583b0448e
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgp699GNtL1e5:V6a+pOtEvwDpjtzT

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012331-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012331-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2212	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2240	2024-03-06_631064afef31926c9f49708c6881e0e0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2212	2240	2024-03-06_631064afef31926c9f49708c6881e0e0_cryptolocker.exe	28
PID 2240 wrote to memory of 2212	2240	2024-03-06_631064afef31926c9f49708c6881e0e0_cryptolocker.exe	28
PID 2240 wrote to memory of 2212	2240	2024-03-06_631064afef31926c9f49708c6881e0e0_cryptolocker.exe	28
PID 2240 wrote to memory of 2212	2240	2024-03-06_631064afef31926c9f49708c6881e0e0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-06_631064afef31926c9f49708c6881e0e0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_631064afef31926c9f49708c6881e0e0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
131KB

MD5
c28d3f028675271914543c4f304b8565

SHA1
31e6ed3efcc90c6fdb45258ac2477f554fd32a29

SHA256
46614eb968de30c5da7c1f813ffdeac5f4edd6a3876f892a168ed6636f6faeda

SHA512
7643cdd194c0ffcb42e25dd1f389a329b5364807fb74b8c9d00c56bafb04289136ff01a968b7c4a25bfd9b58741864fc6b85176e66757fe91673c24d510e70d5

Download Submit
memory/2212-15-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2212-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2240-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2240-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2240-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download