143a2a2265e223f38b7eb41a1e11101b0f28fbc52336bc87a6d57dc09c59897c

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_50becdd67535ade8a923051a765ce151_cryptolocker.exe
Size

38KB
MD5

50becdd67535ade8a923051a765ce151
SHA1

80b8655a958521e68f4dd33b91c77c7ea96a4562
SHA256

143a2a2265e223f38b7eb41a1e11101b0f28fbc52336bc87a6d57dc09c59897c
SHA512

3a999cf93f837b94c126080d1d091bbe5504f883be0962c3df0fdb65c961674002fb1a076fd12d4aef5de09c50946205903f4543b77390911cf5c82cdd5b9eda
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcfw:X6QFElP6n+gJQMOtEvwDpjBsYK6w

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012240-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0008000000012240-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2100	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2320	2024-03-26_50becdd67535ade8a923051a765ce151_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 2100	2320	2024-03-26_50becdd67535ade8a923051a765ce151_cryptolocker.exe	28
PID 2320 wrote to memory of 2100	2320	2024-03-26_50becdd67535ade8a923051a765ce151_cryptolocker.exe	28
PID 2320 wrote to memory of 2100	2320	2024-03-26_50becdd67535ade8a923051a765ce151_cryptolocker.exe	28
PID 2320 wrote to memory of 2100	2320	2024-03-26_50becdd67535ade8a923051a765ce151_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-26_50becdd67535ade8a923051a765ce151_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_50becdd67535ade8a923051a765ce151_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
30f952c9720cf6187dda5511b0615da4

SHA1
f27bfc283cf1a9a1b3ebb0cad3509d6d3ac242a8

SHA256
822d880d2893a069fa657ea075f420f72c8862903faefc2d2c60063208b728e1

SHA512
6af8759c1d31357339136f7af4383ec5215083431560b433dbf6651e1a1ebb10ff34237f199b78a50e61164508870398c3e68c71ea37ba994e82508f6a1a8619

Download Submit
memory/2100-16-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2100-15-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2320-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2320-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2320-3-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download