4c000421bed10b1f8241d31bbeab80b8a6def5697a2ac1d8b7602e4c82694a7b

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
11-03-2024 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-11_6c5cbec10ed25a03fdae1b0f347c0436_cryptolocker.exe
Size

46KB
MD5

6c5cbec10ed25a03fdae1b0f347c0436
SHA1

2cd6e1c44e11a539ed38ab015924a4ab01bc0701
SHA256

4c000421bed10b1f8241d31bbeab80b8a6def5697a2ac1d8b7602e4c82694a7b
SHA512

02390b0b2cb73e138342ee173dc05e1fa0019dc75dec9dd58d817973c71edddbad516bbece5e22d1347d834862ceb648cffdec1d5179973c51d4ebab76769713
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3oUIDLY:X6QFElP6n+gJQMOtEvwDpjBrU0U

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001232e-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001232e-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2744	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1684	2024-03-11_6c5cbec10ed25a03fdae1b0f347c0436_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1684 wrote to memory of 2744	1684	2024-03-11_6c5cbec10ed25a03fdae1b0f347c0436_cryptolocker.exe	28
PID 1684 wrote to memory of 2744	1684	2024-03-11_6c5cbec10ed25a03fdae1b0f347c0436_cryptolocker.exe	28
PID 1684 wrote to memory of 2744	1684	2024-03-11_6c5cbec10ed25a03fdae1b0f347c0436_cryptolocker.exe	28
PID 1684 wrote to memory of 2744	1684	2024-03-11_6c5cbec10ed25a03fdae1b0f347c0436_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-11_6c5cbec10ed25a03fdae1b0f347c0436_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-11_6c5cbec10ed25a03fdae1b0f347c0436_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1684
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2744

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
04eaaed666a1a26e879eb50fd4d9cca5

SHA1
685cf6fb9961ca9dbaa770ea999f3cd1e217aee2

SHA256
e59305fe3c6fe4131f5aea96eeebca9b61405802cf0844e7199e58e510167547

SHA512
a2be6c749546e07c4e9f9230573f7c9d085640a16a80a44bd5a675ac32dbd0e3cbac101e27c7db23dffcc692efe0de52007e4d54af583d7ecaade015a5f84e2b

Download Submit
memory/1684-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1684-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1684-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2744-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2744-22-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download