7c957600c8a9fe1f0ca4f1a42bc74471d0e1840728d674415f0f9bba3bce8aa5

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/03/2024, 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_ac3a5059cb8a09af789ec4d20fed52e0_cryptolocker.exe
Size

131KB
MD5

ac3a5059cb8a09af789ec4d20fed52e0
SHA1

0221fe2bd2f1ce72f8f1a0c156b7396d4c2786a0
SHA256

7c957600c8a9fe1f0ca4f1a42bc74471d0e1840728d674415f0f9bba3bce8aa5
SHA512

5a8b81a7c9f560154546b959cd4b175f2f711e285ada59f10d614e5bf2e9d6ccf17fc8cdef886bd16ed2dcb3edc8d80b23504675e5f425518a1869410ebb53a8
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgp699GNtL1eyk:V6a+pOtEvwDpjtz5

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001222a-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001222a-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3060	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2832	2024-03-15_ac3a5059cb8a09af789ec4d20fed52e0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3060	2832	2024-03-15_ac3a5059cb8a09af789ec4d20fed52e0_cryptolocker.exe	28
PID 2832 wrote to memory of 3060	2832	2024-03-15_ac3a5059cb8a09af789ec4d20fed52e0_cryptolocker.exe	28
PID 2832 wrote to memory of 3060	2832	2024-03-15_ac3a5059cb8a09af789ec4d20fed52e0_cryptolocker.exe	28
PID 2832 wrote to memory of 3060	2832	2024-03-15_ac3a5059cb8a09af789ec4d20fed52e0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-15_ac3a5059cb8a09af789ec4d20fed52e0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_ac3a5059cb8a09af789ec4d20fed52e0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
131KB

MD5
8744fdf44f9e50f873d62f4bb95b2abd

SHA1
622c542aac7831b0b23cf9ffdbb17c8ab3bfbb63

SHA256
015705591d49d98dae44f5fc462c9572acea522f71c64db162136d881b6813d3

SHA512
3631a6f9574b6f0c64fb4ed5052154aecbc559c32fc46f20aeaf19df3d22b927795112a47c3e6a0c127bff1b3d3c1c1d79b9348522beb069572fdeec90bd44bb

Download Submit
memory/2832-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2832-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2832-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3060-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/3060-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download