f76386ce8ffd81cc1b8cbf79def4229150565bbe887ce91de75a23e32adaf8da

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_e6ddbf56bd7b480d4949213e679dec81_cryptolocker.exe
Size

41KB
MD5

e6ddbf56bd7b480d4949213e679dec81
SHA1

ac8843dad9c5c1c0fe445081f096a1da3e143c54
SHA256

f76386ce8ffd81cc1b8cbf79def4229150565bbe887ce91de75a23e32adaf8da
SHA512

ba422dc39c29b7dbb56fabe70abcbfd4889685e0d644cfebb8ab6cf536e47d5103d24d9633c2a328154291735f7dadf85a3ff7a72132f7c7e8ebf1df33ccc7dd
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOSRx:V6QFElP6n+gMQMOtEvwDpjyaYaFAr

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000013ab9-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000013ab9-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2504	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	2024-03-19_e6ddbf56bd7b480d4949213e679dec81_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2504	2932	2024-03-19_e6ddbf56bd7b480d4949213e679dec81_cryptolocker.exe	28
PID 2932 wrote to memory of 2504	2932	2024-03-19_e6ddbf56bd7b480d4949213e679dec81_cryptolocker.exe	28
PID 2932 wrote to memory of 2504	2932	2024-03-19_e6ddbf56bd7b480d4949213e679dec81_cryptolocker.exe	28
PID 2932 wrote to memory of 2504	2932	2024-03-19_e6ddbf56bd7b480d4949213e679dec81_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-19_e6ddbf56bd7b480d4949213e679dec81_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_e6ddbf56bd7b480d4949213e679dec81_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
21625316d9798a31d53647a3c86d8011

SHA1
c8bb535fea580b371f7514f454d18c1379a12521

SHA256
2a7751fab4cd295a6187c75316bbb4f61e893309067d599f06fea5800790a83d

SHA512
c037d46915fc423fab2ba7a95a8f6113efdc40011790561de5d9780426636a973e9fcded45ead959b2b4f6c49b2c52dceada0c512c5ae90380fad81dfc419e8e

Download Submit
memory/2504-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2504-18-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2932-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2932-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2932-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download