060e55ae4d3fefc274097313e271dc143b32cb5b1be9652fc762cea2e4cc6ff1

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-03-2024 20:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_fbf5b36c6b15af92fa7b1cfb2dfc80e8_cryptolocker.exe
Size

70KB
MD5

fbf5b36c6b15af92fa7b1cfb2dfc80e8
SHA1

99fcf63832e53f947fc9a5b752fddd3f6f2768d5
SHA256

060e55ae4d3fefc274097313e271dc143b32cb5b1be9652fc762cea2e4cc6ff1
SHA512

7bc9d238b84c62c1bcbe50c45d24805c95b399ae4b6e7ac356fbb1810d6e77fb135a3ba10ee91bdcd9e93d512ab97da16678b5652062f5df380f27ba0d2e7eab
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUoRg:DW60sllyWOtEvwDpjwF85/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1704-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000e00000001224e-16.dat	CryptoLocker_rule2
behavioral1/memory/2264-18-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1704-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1704-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000e00000001224e-16.dat	CryptoLocker_set1
behavioral1/memory/2264-18-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2264	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1704	2024-03-27_fbf5b36c6b15af92fa7b1cfb2dfc80e8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1704 wrote to memory of 2264	1704	2024-03-27_fbf5b36c6b15af92fa7b1cfb2dfc80e8_cryptolocker.exe	28
PID 1704 wrote to memory of 2264	1704	2024-03-27_fbf5b36c6b15af92fa7b1cfb2dfc80e8_cryptolocker.exe	28
PID 1704 wrote to memory of 2264	1704	2024-03-27_fbf5b36c6b15af92fa7b1cfb2dfc80e8_cryptolocker.exe	28
PID 1704 wrote to memory of 2264	1704	2024-03-27_fbf5b36c6b15af92fa7b1cfb2dfc80e8_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-27_fbf5b36c6b15af92fa7b1cfb2dfc80e8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_fbf5b36c6b15af92fa7b1cfb2dfc80e8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1704
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
71KB

MD5
f69244d115d98f95b6b908dbe928802b

SHA1
c1424478aecbfa82522eea6c0438333fc993ba44

SHA256
53c9d1846d02c0c8da48da6b9fa696ace99132d54c5d4b6641cc0f2f0de58580

SHA512
153104a1cc163e4fa49c36877ee229d37e7a46bfc5a5b5966d8e63b76eb95e636d09a22f2f979ac2fabc3e36b97f72ba2c39e7acea7b421ab676ad297ee9e9b3

Download Submit
memory/1704-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1704-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1704-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1704-4-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1704-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1704-14-0x00000000026C0000-0x00000000026CB000-memory.dmp

Filesize
44KB

Download
memory/2264-18-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2264-20-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2264-19-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download