c203c7ab95f18bb93db70469319ef211d23b9f9417741e2dcf675b718a37aa4a

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
13/03/2024, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_5dd7df4a6f463bea6cca241b81ba9902_cryptolocker.exe
Size

104KB
MD5

5dd7df4a6f463bea6cca241b81ba9902
SHA1

1362c5cbd8b943875dff7fa773b004137a00024b
SHA256

c203c7ab95f18bb93db70469319ef211d23b9f9417741e2dcf675b718a37aa4a
SHA512

1fb7dfe3ed8d6f9e41b1b2b378b1518f01c4e9cd4f1296450457091e6653cebd63b7b04f8cde0e393b05647e60f5991bbbbf97914c8841049b76faa7a7b86c3f
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgpQbCJhV:V6a+pOtEvwDpjtzE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014abe-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014abe-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3008	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2368	2024-03-13_5dd7df4a6f463bea6cca241b81ba9902_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 3008	2368	2024-03-13_5dd7df4a6f463bea6cca241b81ba9902_cryptolocker.exe	28
PID 2368 wrote to memory of 3008	2368	2024-03-13_5dd7df4a6f463bea6cca241b81ba9902_cryptolocker.exe	28
PID 2368 wrote to memory of 3008	2368	2024-03-13_5dd7df4a6f463bea6cca241b81ba9902_cryptolocker.exe	28
PID 2368 wrote to memory of 3008	2368	2024-03-13_5dd7df4a6f463bea6cca241b81ba9902_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-13_5dd7df4a6f463bea6cca241b81ba9902_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_5dd7df4a6f463bea6cca241b81ba9902_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
104KB

MD5
15379f29bc6455780afa1ba61e197be4

SHA1
4e37e902c67ba90603ab4aeb2e9c000254ce5dc2

SHA256
3347815bd6c97acfef2a4a8cfd2db8a5439dc7af84c38c6880c08662f0d6eb49

SHA512
2304a20f1837e72f161e6371a465e08b243e2b4f7d47c65f1374a4faa77c3957513ad0fb1b90ea02744fbd6922788f06b4283654dd6be7885d829cb0edb3e4e9

Download Submit
memory/2368-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2368-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2368-3-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/3008-15-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/3008-18-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download