127ed5d46a285732f384e93a92b4095ba35860e4f603e56076a0bd206cd01154

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-04-2024 20:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-04_8347fd9f3f5f45797fb5de453636d0e0_cryptolocker.exe
Size

64KB
MD5

8347fd9f3f5f45797fb5de453636d0e0
SHA1

bc54a6a55172df823cff8fea279ae017e787fed1
SHA256

127ed5d46a285732f384e93a92b4095ba35860e4f603e56076a0bd206cd01154
SHA512

d4363a04698640ed2224e150a559f1abef772d36819bd1bf5131e062a00890b39aebdd2b21adbed99deee8c3156c17589bc50b6f5a2dd44e48d583ed6c2a3bfb
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbmhkP:V6a+pOtEvwDpjvK

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000e000000012248-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000e000000012248-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2644	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2112	2024-04-04_8347fd9f3f5f45797fb5de453636d0e0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2644	2112	2024-04-04_8347fd9f3f5f45797fb5de453636d0e0_cryptolocker.exe	28
PID 2112 wrote to memory of 2644	2112	2024-04-04_8347fd9f3f5f45797fb5de453636d0e0_cryptolocker.exe	28
PID 2112 wrote to memory of 2644	2112	2024-04-04_8347fd9f3f5f45797fb5de453636d0e0_cryptolocker.exe	28
PID 2112 wrote to memory of 2644	2112	2024-04-04_8347fd9f3f5f45797fb5de453636d0e0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-04_8347fd9f3f5f45797fb5de453636d0e0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-04_8347fd9f3f5f45797fb5de453636d0e0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
b9bd966e6d7c8c9a502076972e4ee343

SHA1
676a78333c3086dda7c6d28877508b7f0b5394f6

SHA256
1bfbf3e6861cfda9f45a5a638beab406da4b0b6a6b82cd5848df45d1398a94ff

SHA512
733f84e8c97cf2db8b916fae42eb237e8dbc98b1b1f72b00e326239efd87f44331aae67e41439377d4c1e957a870abb8d12ba484cdfe6d87901ca38b57a67bf2

Download Submit
memory/2112-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2112-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2112-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2644-16-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2644-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download