6e75d3c9ddc1c404bca7d42566b73c23c046bb7b0c17097206865f928fecbffe

Analysis

max time kernel
173s
max time network
188s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/03/2024, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-19_0a0db47cd517b2c85553e502e0100203_cryptolocker.exe
Size

69KB
MD5

0a0db47cd517b2c85553e502e0100203
SHA1

f36e10deed6070faa29f3bafc189d19585e331d6
SHA256

6e75d3c9ddc1c404bca7d42566b73c23c046bb7b0c17097206865f928fecbffe
SHA512

c49fa12c2cac91cac2bda273b099ed928343caeaf79e97dda4d67be5aefa5a5509c474f73434242fb0a1cea26c25e867289acede69a429a34997d0c389c0c00c
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUb0:DW60sllyWOtEvwDpjwF85i

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0008000000012245-11.dat	CryptoLocker_rule2
behavioral1/memory/2856-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2588-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2856-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0008000000012245-11.dat	CryptoLocker_set1
behavioral1/memory/2856-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2588-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2588	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2856	2024-03-19_0a0db47cd517b2c85553e502e0100203_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2856 wrote to memory of 2588	2856	2024-03-19_0a0db47cd517b2c85553e502e0100203_cryptolocker.exe	27
PID 2856 wrote to memory of 2588	2856	2024-03-19_0a0db47cd517b2c85553e502e0100203_cryptolocker.exe	27
PID 2856 wrote to memory of 2588	2856	2024-03-19_0a0db47cd517b2c85553e502e0100203_cryptolocker.exe	27
PID 2856 wrote to memory of 2588	2856	2024-03-19_0a0db47cd517b2c85553e502e0100203_cryptolocker.exe	27

C:\Users\Admin\AppData\Local\Temp\2024-03-19_0a0db47cd517b2c85553e502e0100203_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-19_0a0db47cd517b2c85553e502e0100203_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2856
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
69KB

MD5
a81b91b601e411ad7547226af90870c5

SHA1
de1a07bc5a8daf1066652e56b841d3d4b775fefd

SHA256
bfc231a90d9e1e93e12d00d90fba716e5e6a1245d80a2128c9bc3717a56038aa

SHA512
e5b1eee496c5d0b694a56ac1326f7f60ab105d887842f9d4e53378248faa1c472d0973c77454fbf435d28aa728fe32c0b73c6e691523a9608af2f74f3f0d78e4

Download Submit
memory/2588-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2588-19-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2588-18-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2856-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2856-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2856-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2856-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2856-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download