6d302b319668e9a880cc8ebc35ce92b4204e643c24085f7b6b65e553f8202671

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-05_cc8c307f727c2c4c6c50f9425e34fd3e_cryptolocker.exe
Size

57KB
MD5

cc8c307f727c2c4c6c50f9425e34fd3e
SHA1

02e37e10f5d45ecba24b601a7292cac5fdef0968
SHA256

6d302b319668e9a880cc8ebc35ce92b4204e643c24085f7b6b65e553f8202671
SHA512

f79c1b775f10aa7d0f4fe111f975b9f61e8724666092b1d9f7b4e9eb738ea53cdc7e2e5f4608f608f4015b3a46f3475894c50e67642492e5cdf0bae864e15d8a
SSDEEP

1536:X6QFElP6n+gJBMOtEvwDpjBtE1yILJ0V5V:X6a+BOtEvwDpjBOA

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001224d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2168	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2960	2024-04-05_cc8c307f727c2c4c6c50f9425e34fd3e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2168	2960	2024-04-05_cc8c307f727c2c4c6c50f9425e34fd3e_cryptolocker.exe	28
PID 2960 wrote to memory of 2168	2960	2024-04-05_cc8c307f727c2c4c6c50f9425e34fd3e_cryptolocker.exe	28
PID 2960 wrote to memory of 2168	2960	2024-04-05_cc8c307f727c2c4c6c50f9425e34fd3e_cryptolocker.exe	28
PID 2960 wrote to memory of 2168	2960	2024-04-05_cc8c307f727c2c4c6c50f9425e34fd3e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-05_cc8c307f727c2c4c6c50f9425e34fd3e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-05_cc8c307f727c2c4c6c50f9425e34fd3e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
57KB

MD5
0639623fbf68714ab051bb4f20632f89

SHA1
3c79a98895a64058e3d4de54d3b3c36fba1f7c84

SHA256
fa9f244718f6b55a61e175f5c3ebefb5670c25ce420d023aeb3235059701ce7b

SHA512
1e7e2d213e7d2ed30136c6783018a1fe9c0e427dc91df85c27420ad37277a53169fd4b7ebaa95e6ace13b5eb6338ef5ca1a08349423a77af5378d515b28780d0

Download Submit
memory/2168-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2168-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2960-0-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2960-1-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2960-7-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download