Analysis

  • max time kernel
    137s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    19-03-2024 09:28

General

  • Target

    2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe

  • Size

    44KB

  • MD5

    2cdd44f9c578df0bb95aa8735b345fa1

  • SHA1

    fa83eeaa737d6c10a5daa176f107d14ad7a01e25

  • SHA256

    01b16c3daabd2d736757d6705c4ae6aa6dffe86a793151c24f6ac6a5b1b59c37

  • SHA512

    069288a4907d3cc022b1b7acddcbefa14599c69465851bad9c09348b6d5e5784130ed57bea26cce561f1ef02606cd98963177a7ec35a9f70126bdea78907be5f

  • SSDEEP

    768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkHu:P6Q0ElP6G+gJQMOtEvwDpjB8WMlsu

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 6 IoCs
  • Detection of Cryptolocker Samples 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-19_2cdd44f9c578df0bb95aa8735b345fa1_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2964
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    44KB

    MD5

    4e393b0b850f7e9e1485554539816052

    SHA1

    05f60fdada885e5ddac568ea5e9dc3b084aa8ddf

    SHA256

    76dc45914499719b828166f95e2314473d2c77d77fae6997e062d25b246db361

    SHA512

    1a5dbd56366926bba408199de62afa4b3b77c5c612d7d157a349feb0f591d832fd714e2c55da577d713faedf641adc9af26c16b34b4b1a76f9696fc67e220972

  • memory/2712-17-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2712-19-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/2712-21-0x0000000000450000-0x0000000000456000-memory.dmp

    Filesize

    24KB

  • memory/2712-27-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2964-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2964-1-0x0000000000330000-0x0000000000336000-memory.dmp

    Filesize

    24KB

  • memory/2964-2-0x0000000000460000-0x0000000000466000-memory.dmp

    Filesize

    24KB

  • memory/2964-4-0x0000000000330000-0x0000000000336000-memory.dmp

    Filesize

    24KB

  • memory/2964-15-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2964-13-0x0000000000610000-0x000000000061B000-memory.dmp

    Filesize

    44KB