cf68828eac36ee3a73e3eb9cef266c6f8283966767211208c690f5266a419063

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/03/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_2b3159ea146ce680abc8bcb42739e9c0_cryptolocker.exe
Size

104KB
MD5

2b3159ea146ce680abc8bcb42739e9c0
SHA1

87ee21b396ea17eea8d19ebbf2d489e2708e952f
SHA256

cf68828eac36ee3a73e3eb9cef266c6f8283966767211208c690f5266a419063
SHA512

771198136a4d2fbaf46939d6603e3dc5c56c8e02aca26b592cc4aca7b44330639dda850a65de66447a04cfac140a07fdef306229d0617023cc5b4c1972edd4b9
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgp69sP:V6a+pOtEvwDpjtzw

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000e000000012248-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000e000000012248-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2952	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2288	2024-03-06_2b3159ea146ce680abc8bcb42739e9c0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2952	2288	2024-03-06_2b3159ea146ce680abc8bcb42739e9c0_cryptolocker.exe	28
PID 2288 wrote to memory of 2952	2288	2024-03-06_2b3159ea146ce680abc8bcb42739e9c0_cryptolocker.exe	28
PID 2288 wrote to memory of 2952	2288	2024-03-06_2b3159ea146ce680abc8bcb42739e9c0_cryptolocker.exe	28
PID 2288 wrote to memory of 2952	2288	2024-03-06_2b3159ea146ce680abc8bcb42739e9c0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-06_2b3159ea146ce680abc8bcb42739e9c0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_2b3159ea146ce680abc8bcb42739e9c0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
104KB

MD5
d8f3bf1fb1c5ae718e44dfb3b9a68f18

SHA1
fa0a89a6a12ac5d13c3dfc163f40dce4a94ffd30

SHA256
c1db6a2cee394d4e98ae12440ee98541783a4bee5c0ef57aac5d9995f8789f9b

SHA512
07aee2706e9b24a6f2fd4a7dedd9adf034176057b1b3cbf18c79abf69f3af62aa4675c73f4cb6df9df0c904196e711f33695761797c4eb202e91adde232180b4

Download Submit
memory/2288-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2288-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2288-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2952-16-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2952-15-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download