b87e0dcbcc61d43b13df33caff9c1159c1a78e27aa4b03aa5a123290916c6dbc

Analysis

max time kernel
157s
max time network
163s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/03/2024, 04:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_94649797d19bff4393586995409e3bb1_cryptolocker.exe
Size

55KB
MD5

94649797d19bff4393586995409e3bb1
SHA1

2ff36231774ad99ba69594b67356ef07405c0130
SHA256

b87e0dcbcc61d43b13df33caff9c1159c1a78e27aa4b03aa5a123290916c6dbc
SHA512

a7cff6bf8d8bcf198eb3d13f9b905bba617a17d2961dac6ab99d62e11247dabcc324d833fd1e2a1599a73602706e9c2797abb92238dcc4bfe4ce94a204df1e82
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTiSfQaV2L0zN/Pcmr:X6QFElP6n+gJBMOtEvwDpjBtE1yILOkg

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012248-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012248-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2104	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3052	2024-03-16_94649797d19bff4393586995409e3bb1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2104	3052	2024-03-16_94649797d19bff4393586995409e3bb1_cryptolocker.exe	27
PID 3052 wrote to memory of 2104	3052	2024-03-16_94649797d19bff4393586995409e3bb1_cryptolocker.exe	27
PID 3052 wrote to memory of 2104	3052	2024-03-16_94649797d19bff4393586995409e3bb1_cryptolocker.exe	27
PID 3052 wrote to memory of 2104	3052	2024-03-16_94649797d19bff4393586995409e3bb1_cryptolocker.exe	27

C:\Users\Admin\AppData\Local\Temp\2024-03-16_94649797d19bff4393586995409e3bb1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_94649797d19bff4393586995409e3bb1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2104

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
55KB

MD5
b4474c2d0c3e1106200983fa367fb049

SHA1
97a547c5ec1411fcc8ec6794835be995e262da92

SHA256
023fb60daf6c27928bb3490a77e997e7ba61cc4a099ad6fd60dd7c3157fa0784

SHA512
dbd42818e18d5ed606f3bbe3ce56c4c5b83e54f145fca1a6dd8dee4168e4859173453de8c00b4a092604f65df1d7798bbaa0b2b7f54dc0ca6ea412c2e60696ee

Download Submit
memory/2104-15-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/3052-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3052-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3052-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download