89d57eac4663b6e0c285b18821e9137a7e78add5e1abc64bd1453d75e9d710c8

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/03/2024, 21:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-14_dbbc2b5b6063a9a31891d19af545852f_cryptolocker.exe
Size

75KB
MD5

dbbc2b5b6063a9a31891d19af545852f
SHA1

fccc13e692ccc06a67ae53ba6aa62d3948ae2952
SHA256

89d57eac4663b6e0c285b18821e9137a7e78add5e1abc64bd1453d75e9d710c8
SHA512

c243b883cfaadee9ff7e89b6b88134fc3303b7282841d73b03b87a2de3aad4c619fb907f1764a50a4d25489f1be3bbc255989cb479837cce6511fa8dcbf4f16d
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1siMOg:X6a+SOtEvwDpjBZYvQd2a

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012251-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012251-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2736	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2324	2024-03-14_dbbc2b5b6063a9a31891d19af545852f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 2736	2324	2024-03-14_dbbc2b5b6063a9a31891d19af545852f_cryptolocker.exe	28
PID 2324 wrote to memory of 2736	2324	2024-03-14_dbbc2b5b6063a9a31891d19af545852f_cryptolocker.exe	28
PID 2324 wrote to memory of 2736	2324	2024-03-14_dbbc2b5b6063a9a31891d19af545852f_cryptolocker.exe	28
PID 2324 wrote to memory of 2736	2324	2024-03-14_dbbc2b5b6063a9a31891d19af545852f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-14_dbbc2b5b6063a9a31891d19af545852f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-14_dbbc2b5b6063a9a31891d19af545852f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
75KB

MD5
3194f624231a71615d6d5a50073b6b2a

SHA1
f849c6e29a0c199e710d39a1c21c2d6aff42917a

SHA256
77d972057aad9a289ad120a30e7619bfe00df53277a90ae53a47d327a2735fc0

SHA512
dedec75582ae81bcfa6770e9872179564f70df591db04976a1112dd1bd6c07703fdf4673c6722916434fc3208d7d85b0a15c0967fef2ce4946d6f16223d87466

Download Submit
memory/2324-0-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2324-1-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2324-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2736-15-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2736-18-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download