07f8783ffe29f5c9c490bcb3d9f9614892c4148145265b16bf73ea5e231a9339

Analysis

max time kernel
154s
max time network
158s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/03/2024, 23:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-10_0fdda148d3be5186515e69b081a66d73_cryptolocker.exe
Size

37KB
MD5

0fdda148d3be5186515e69b081a66d73
SHA1

1bb27257c66a2061256c6adb25d3e8a457c5b32e
SHA256

07f8783ffe29f5c9c490bcb3d9f9614892c4148145265b16bf73ea5e231a9339
SHA512

a84bd4708f02118b1d81df3c0c23c1980a1c617c3804802f34480cd5323cd182014d17eb769136bf37fea2b4e8e0c4fc7b018c8f6408aae7730f25d04543519b
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5axP:V6QFElP6n+gMQMOtEvwDpjyaYa5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012267-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012267-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1080	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2980	2024-03-10_0fdda148d3be5186515e69b081a66d73_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1080	2980	2024-03-10_0fdda148d3be5186515e69b081a66d73_cryptolocker.exe	28
PID 2980 wrote to memory of 1080	2980	2024-03-10_0fdda148d3be5186515e69b081a66d73_cryptolocker.exe	28
PID 2980 wrote to memory of 1080	2980	2024-03-10_0fdda148d3be5186515e69b081a66d73_cryptolocker.exe	28
PID 2980 wrote to memory of 1080	2980	2024-03-10_0fdda148d3be5186515e69b081a66d73_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-10_0fdda148d3be5186515e69b081a66d73_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_0fdda148d3be5186515e69b081a66d73_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
271783eb4d55eba0f53a09721ab1396f

SHA1
8ea6a77b85d45d15a9ac7a84d53c8ffb3bfc8688

SHA256
06bca34db1c291d4452dedead59a79eed836d2d9a05ef5b5d8e379eb4fda81d2

SHA512
783e1b514525cca8ca9da0ab6fa90e4422bc8b0735b1b501708f88498978c9127f9078119b832e0cdb66c5fbfb883eb6276a7b7be75f6fb429df6bf7b7033a37

Download Submit
memory/1080-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1080-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2980-0-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2980-1-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2980-3-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download