490f5128ce004258761c92a8d2a5c45d3ce1832db1e3071c570ad7e9d5b981bf

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/03/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-12_22fb7a1a8d06613c2b9012eb1676dda0_cryptolocker.exe
Size

69KB
MD5

22fb7a1a8d06613c2b9012eb1676dda0
SHA1

b137df13c122146eccc209d9ca0ba76ebcb834a0
SHA256

490f5128ce004258761c92a8d2a5c45d3ce1832db1e3071c570ad7e9d5b981bf
SHA512

a5bb83498cf98c4e238cdab06a26032d6fc068fcd00bb1fb94368e028db63de7bc6ff21f4a195d64bdb738c31fa5b88bcada573e764c3919ddd1773443ee4519
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUsM0:DW60sllyWOtEvwDpjwF85u

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x00090000000155ed-11.dat	CryptoLocker_rule2
behavioral1/memory/2244-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2244-15-0x00000000005B0000-0x00000000005BB000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1156-18-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2244-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x00090000000155ed-11.dat	CryptoLocker_set1
behavioral1/memory/2244-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1156-18-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1156	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2244	2024-03-12_22fb7a1a8d06613c2b9012eb1676dda0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1156	2244	2024-03-12_22fb7a1a8d06613c2b9012eb1676dda0_cryptolocker.exe	28
PID 2244 wrote to memory of 1156	2244	2024-03-12_22fb7a1a8d06613c2b9012eb1676dda0_cryptolocker.exe	28
PID 2244 wrote to memory of 1156	2244	2024-03-12_22fb7a1a8d06613c2b9012eb1676dda0_cryptolocker.exe	28
PID 2244 wrote to memory of 1156	2244	2024-03-12_22fb7a1a8d06613c2b9012eb1676dda0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-12_22fb7a1a8d06613c2b9012eb1676dda0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_22fb7a1a8d06613c2b9012eb1676dda0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
69KB

MD5
031699a7df04a36d0bd7d31a43cd14ca

SHA1
cdcaed8080095a38b95375fc44c5b4aba24ddbaa

SHA256
6f699651b128fb8b81d5245b0144a28b0c84800e87be050fc94e89991efc6c73

SHA512
8cb5d42264967ecb1a927993c8484ee4653293e78e9438b9c4a27f8bfe3f89ff1a8b471062d5251bf49750fe64ed955882587838cf5c0e52e9a753a060741502

Download Submit
memory/1156-18-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1156-19-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1156-20-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2244-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2244-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2244-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2244-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2244-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2244-15-0x00000000005B0000-0x00000000005BB000-memory.dmp

Filesize
44KB

Download