a8695e1bfc97462a4fefbf41ef7c01ebf3f1c855e2cc9ef3342d49a11f766878

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-11_afa04c34794d6372b64159bb89f781b0_cryptolocker.exe
Size

71KB
MD5

afa04c34794d6372b64159bb89f781b0
SHA1

e478f2360535f379d1079c4e37f64929d51a95f7
SHA256

a8695e1bfc97462a4fefbf41ef7c01ebf3f1c855e2cc9ef3342d49a11f766878
SHA512

d35e89c04cdda0b9a2eb974d3c828cfaf56eeadbe1ef1a7103f84d24fdffdd11989e36cd5c22bdb1f4aded85cffa233a36139c9e15f20bd378333f498a3ee2e0
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1Uj:X6a+SOtEvwDpjBZYvQd2Y

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001223a-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001223a-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2100	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2256	2024-03-11_afa04c34794d6372b64159bb89f781b0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2100	2256	2024-03-11_afa04c34794d6372b64159bb89f781b0_cryptolocker.exe	28
PID 2256 wrote to memory of 2100	2256	2024-03-11_afa04c34794d6372b64159bb89f781b0_cryptolocker.exe	28
PID 2256 wrote to memory of 2100	2256	2024-03-11_afa04c34794d6372b64159bb89f781b0_cryptolocker.exe	28
PID 2256 wrote to memory of 2100	2256	2024-03-11_afa04c34794d6372b64159bb89f781b0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-11_afa04c34794d6372b64159bb89f781b0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-11_afa04c34794d6372b64159bb89f781b0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
71KB

MD5
a71d09c4de67817919efa197b61f001b

SHA1
ac239c947bcf5c475e6e4cbb8d2a918e6e43a646

SHA256
f4cbd5e0b5b3e1d71ada85c57c9321e183375f7f4f20e482e359c7b27ec64e5e

SHA512
50da78656314dfc0891ef2a27c7247c16c626a5dc43790dc6f33476f4da05697d67f3c67a6e05c43bb55ef95abe124eecfac65c4a755710925a17de216436ef7

Download Submit
memory/2100-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2100-18-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2256-0-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2256-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2256-3-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download