277e9752a627b093d47ef5798730f18b79df599022319d5366f65b030cae6c02

Analysis

max time kernel
134s
max time network
145s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-03-2024 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe
Size

74KB
MD5

15547bbd8ac21356aa0feb1d5f0999bc
SHA1

2ad1c9e4ecddb622b726bef7d69185cb18e635ef
SHA256

277e9752a627b093d47ef5798730f18b79df599022319d5366f65b030cae6c02
SHA512

3c4c4206d8d374257790dc75235b79d05df135ac99b8c2e8d933d6cc9591b56b91cbb806e529d6999041f01c383eaa871e2c342ee646062e44da23841d4a57c9
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1sA:X6a+SOtEvwDpjBZYvQd2T

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2232	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2232	2320	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe	28
PID 2320 wrote to memory of 2232	2320	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe	28
PID 2320 wrote to memory of 2232	2320	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe	28
PID 2320 wrote to memory of 2232	2320	2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_15547bbd8ac21356aa0feb1d5f0999bc_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
75KB

MD5
5824580c2da1459c2f1d40c27649a995

SHA1
b7f2362f98a32e319eeee402ad2f4f641cbe4c31

SHA256
c1b4cb019cc6fb5b41630a93bd7d98e22a0efa0c0079a3162618dab04ca29397

SHA512
e5bf39d9a059dd7a83c8bceef5b5bf0c4a53aeace56a7ab4e018aa42cd1bb005f9b3a0920ac31f25c42278d96ff41731d2ca47ff3fd44a8f3b18e540c4a307c7

Download Submit
memory/2232-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2320-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2320-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2320-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download