cc1649f69a853ca5f34f39a126c0eeaf8ef21ae6d0858b40422823c8f7b8a92b

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 21:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-11_1d888555e49ac15d08db5f371d34aa03_cryptolocker.exe
Size

35KB
MD5

1d888555e49ac15d08db5f371d34aa03
SHA1

7608f6a37815c016a38d2a28c596643370eb5342
SHA256

cc1649f69a853ca5f34f39a126c0eeaf8ef21ae6d0858b40422823c8f7b8a92b
SHA512

dcb94d9dd6d42ad7196e2f6405b0944d779af9dc2696b2f4e211dc96101d14e7ae542e21f7b22096c5621c3fdc21d6409ec6f70d365d03e20e4234e8ff83e085
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVajSKm5uhy7O4JOiu:X6QFElP6n+gJQMOtEvwDpjBcSKm5uhwS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012247-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012247-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2252	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2240	2024-03-11_1d888555e49ac15d08db5f371d34aa03_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 2252	2240	2024-03-11_1d888555e49ac15d08db5f371d34aa03_cryptolocker.exe	28
PID 2240 wrote to memory of 2252	2240	2024-03-11_1d888555e49ac15d08db5f371d34aa03_cryptolocker.exe	28
PID 2240 wrote to memory of 2252	2240	2024-03-11_1d888555e49ac15d08db5f371d34aa03_cryptolocker.exe	28
PID 2240 wrote to memory of 2252	2240	2024-03-11_1d888555e49ac15d08db5f371d34aa03_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-11_1d888555e49ac15d08db5f371d34aa03_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-11_1d888555e49ac15d08db5f371d34aa03_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
35KB

MD5
deb50b46cc7701cc8765a9f79399535c

SHA1
91510c3e7c528207375c179982e63029af749107

SHA256
2429f8833b2101665f46531105592d31a0c0a0a58677a6bc1e36ea5e4f9fb295

SHA512
c2d08b66ebe2199c7297d0f882173eadeae87c543b743c1bdbde592be7ee716bce75a13fc81060ac0738fea644d3d5f785f3530699f670a7566cb4017c750a52

Download Submit
memory/2240-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2240-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2240-1-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2252-15-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download