Analysis
-
max time kernel
137s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-03-2024 09:28
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe
-
Size
44KB
-
MD5
2cdd44f9c578df0bb95aa8735b345fa1
-
SHA1
fa83eeaa737d6c10a5daa176f107d14ad7a01e25
-
SHA256
01b16c3daabd2d736757d6705c4ae6aa6dffe86a793151c24f6ac6a5b1b59c37
-
SHA512
069288a4907d3cc022b1b7acddcbefa14599c69465851bad9c09348b6d5e5784130ed57bea26cce561f1ef02606cd98963177a7ec35a9f70126bdea78907be5f
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkHu:P6Q0ElP6G+gJQMOtEvwDpjB8WMlsu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
resource yara_rule behavioral1/memory/2964-0-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x0008000000012249-11.dat CryptoLocker_rule2 behavioral1/memory/2964-15-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2712-17-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2964-13-0x0000000000610000-0x000000000061B000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2712-27-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 6 IoCs
resource yara_rule behavioral1/memory/2964-0-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral1/files/0x0008000000012249-11.dat CryptoLocker_set1 behavioral1/memory/2964-15-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral1/memory/2712-17-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral1/memory/2964-13-0x0000000000610000-0x000000000061B000-memory.dmp CryptoLocker_set1 behavioral1/memory/2712-27-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2712 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 2964 2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2964 wrote to memory of 2712 2964 2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe 28 PID 2964 wrote to memory of 2712 2964 2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe 28 PID 2964 wrote to memory of 2712 2964 2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe 28 PID 2964 wrote to memory of 2712 2964 2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2712
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
44KB
MD54e393b0b850f7e9e1485554539816052
SHA105f60fdada885e5ddac568ea5e9dc3b084aa8ddf
SHA25676dc45914499719b828166f95e2314473d2c77d77fae6997e062d25b246db361
SHA5121a5dbd56366926bba408199de62afa4b3b77c5c612d7d157a349feb0f591d832fd714e2c55da577d713faedf641adc9af26c16b34b4b1a76f9696fc67e220972