a61d81fa7fc279b734c02bbd1eb3571dbda00826557bde7e51d59748460849aa

Analysis

max time kernel
162s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/03/2024, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_bb352938aa4cbf50fbf43c0b8d105af3_cryptolocker.exe
Size

124KB
MD5

bb352938aa4cbf50fbf43c0b8d105af3
SHA1

36f95517014a26a0d13803f46dade49b71311ecd
SHA256

a61d81fa7fc279b734c02bbd1eb3571dbda00826557bde7e51d59748460849aa
SHA512

9ca70d33aeac3b282231ef6eacad95dc6e219df5f7c267b34559ad76500803403b2232bb18e5b3f081ea428d49ccaa25e075aaf9cf5b1f68408b9337298d5504
SSDEEP

1536:u6QFElP6n+gWMOtEvwDpjJGYQbN/PKwMgdl4:u6a++OtEvwDpj6zs

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012248-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012248-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2552	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1616	2024-03-09_bb352938aa4cbf50fbf43c0b8d105af3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 2552	1616	2024-03-09_bb352938aa4cbf50fbf43c0b8d105af3_cryptolocker.exe	27
PID 1616 wrote to memory of 2552	1616	2024-03-09_bb352938aa4cbf50fbf43c0b8d105af3_cryptolocker.exe	27
PID 1616 wrote to memory of 2552	1616	2024-03-09_bb352938aa4cbf50fbf43c0b8d105af3_cryptolocker.exe	27
PID 1616 wrote to memory of 2552	1616	2024-03-09_bb352938aa4cbf50fbf43c0b8d105af3_cryptolocker.exe	27

C:\Users\Admin\AppData\Local\Temp\2024-03-09_bb352938aa4cbf50fbf43c0b8d105af3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_bb352938aa4cbf50fbf43c0b8d105af3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
124KB

MD5
c619deed0bfc10c27be47659fa78ef51

SHA1
d8f73e89c4578aa1b44e4aeac2a5d4b26cf10f5e

SHA256
30b9f1545a223d17c8d42582b3b37b5a32c86e5295ea8a09cd2382348be14555

SHA512
d2a5fca888a7dfc16dbeb8c95f9c0399baa84149e0a2197d673d0f8e1e4a9cb907d396d83f08a6b714d1f019909a0d31c3bb7e4551fc37ee44b95941fb8b8a93

Download Submit
memory/1616-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1616-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1616-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2552-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download