671d84988d9483cd352ef52fe0efb1acfd348ce93790f758628582de1f9c10d3

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
16-03-2024 10:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe
Size

44KB
MD5

834ffc2c3d3f37411860665cdb2da445
SHA1

11df27c06ba91ebc1cc1a680ab2ed93c2d31396e
SHA256

671d84988d9483cd352ef52fe0efb1acfd348ce93790f758628582de1f9c10d3
SHA512

a315b356866375a9c1f89f84b8217b78b2194b1b2be703af1e93d0ec66e9798348d0bab70a5e0a137b2f43571e939544d09311bba2d0111d118151e5f5df44e2
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLaHaMMm2X3rtJ:V6QFElP6n+gMQMOtEvwDpjyaHaXvJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000000e610-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000000e610-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3020	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2988	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2988 wrote to memory of 3020	2988	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe	28
PID 2988 wrote to memory of 3020	2988	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe	28
PID 2988 wrote to memory of 3020	2988	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe	28
PID 2988 wrote to memory of 3020	2988	2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-16_834ffc2c3d3f37411860665cdb2da445_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
3a396dd8b29d187159fb8a76b9fa0250

SHA1
fbf30efdc3f1cf0fc5001546c082b91c1f76f3b1

SHA256
0e3726bdecc19be5a22f939b6afda4c9c46127aa39754268a6e30f3105abe2e5

SHA512
2377eece40c40fc2f04d3f12927d1ba99af148f962e142df0bef46edb2760e9d8613a5bab2fd70b46942a15540de7fb4c37ef24c67f6121325dea551ecdb1876

Download Submit
memory/2988-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2988-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2988-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3020-15-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/3020-17-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download