ab2f4603c15ece1c2899f7226ebf9ddc1c76e0c3c486a9d0922011868be48650

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 02:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_5c1a183d0644b1808da3cf2f9f5bd545_cryptolocker.exe
Size

49KB
MD5

5c1a183d0644b1808da3cf2f9f5bd545
SHA1

03cb5b4507e9c56cc55ea82c021f03aff942d602
SHA256

ab2f4603c15ece1c2899f7226ebf9ddc1c76e0c3c486a9d0922011868be48650
SHA512

fb71164b8af1eda2d5a2ea0d03bd297720ef6054697616288d4542a6def35e6ba51f16cdc1489ebaf66eec98f412df535f94080161b66a98492a7a3ec89f1a4c
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55id3AMWZ7:X6QFElP6n+gJQMOtEvwDpjB0GIWiWLV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014b70-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014b70-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3004	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1988	2024-03-19_5c1a183d0644b1808da3cf2f9f5bd545_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3004	1988	2024-03-19_5c1a183d0644b1808da3cf2f9f5bd545_cryptolocker.exe	28
PID 1988 wrote to memory of 3004	1988	2024-03-19_5c1a183d0644b1808da3cf2f9f5bd545_cryptolocker.exe	28
PID 1988 wrote to memory of 3004	1988	2024-03-19_5c1a183d0644b1808da3cf2f9f5bd545_cryptolocker.exe	28
PID 1988 wrote to memory of 3004	1988	2024-03-19_5c1a183d0644b1808da3cf2f9f5bd545_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-19_5c1a183d0644b1808da3cf2f9f5bd545_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_5c1a183d0644b1808da3cf2f9f5bd545_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
e0a05ad6365be9e92393674f083b64e1

SHA1
60308e601f66e6a10788df627b4d3c2fc9433eef

SHA256
26decccb2a42302c98101a4b117676ba4800b0039107efdbad747590fa53810e

SHA512
6b20428d80535593fa9c6922ea575dc3890dd1c1bd2f552fd4c2b33d63bffdc20c45b36909f64aca6710dabc81196d0da87322e5d25ce786dd8565552b75e451

Download Submit
memory/1988-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1988-2-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1988-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/3004-15-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download