8454e45d1ce15cd06e3d8c2d02e0915a28826fbaded695649a30562b44c685a2

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe
Size

47KB
MD5

3f9c35b2ffd4f3c0bc4b701f2b28c38b
SHA1

c9378e27a4b470f2c4c953a11f161f6c5712601f
SHA256

8454e45d1ce15cd06e3d8c2d02e0915a28826fbaded695649a30562b44c685a2
SHA512

fd896a5e3331345fd739e2b8d75619beff859da17483790b1eed90858fef12b406c48cc9e60101303d23158aade07deb9cfa673b826fbee8569cad7bbfb6672e
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXI:X6QFElP6n+gJBMOtEvwDpjBtEdXI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122ac-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c0000000122ac-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3048	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1668	2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 3048	1668	2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe	28
PID 1668 wrote to memory of 3048	1668	2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe	28
PID 1668 wrote to memory of 3048	1668	2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe	28
PID 1668 wrote to memory of 3048	1668	2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_3f9c35b2ffd4f3c0bc4b701f2b28c38b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
0b8ea81b7e2bf930c30ce25645f74111

SHA1
31766e5bece78e1fd3e2e65e54522ec5423ea90b

SHA256
3a7763815828ec970613cf9ee457397859ba9baee26eb2221c979757bbf6bc17

SHA512
0ecd0aa30c6a0631977a18662d63498120b5e5c5bfc842754354bc1b4cca02494d041753b7c83666e297cc92a6a209fe15c063322b64868ddffe9cfa02786d5a

Download Submit
memory/1668-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1668-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1668-3-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/3048-15-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/3048-20-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download