0843fe0d6d924bdad09008a528ba2dbc3f1cdbacae60631ca01d7355c9829f29

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06-04-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_e97d644d06d759731f445e873a66fdc8_cryptolocker.exe
Size

59KB
MD5

e97d644d06d759731f445e873a66fdc8
SHA1

3566c8388f420f31f6188e76275f19f7e0b376fb
SHA256

0843fe0d6d924bdad09008a528ba2dbc3f1cdbacae60631ca01d7355c9829f29
SHA512

e734fa1e1655365bee061237b7dc93a9302d239490f4724d17cc3faefb85bb6f45837b509e23a853a2c2e4b321534fab379c263116bb9bf4e6db9394e624029f
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbtng:V6a+pOtEvwDpjvj

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012241-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012241-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2120	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1784	2024-04-06_e97d644d06d759731f445e873a66fdc8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 2120	1784	2024-04-06_e97d644d06d759731f445e873a66fdc8_cryptolocker.exe	28
PID 1784 wrote to memory of 2120	1784	2024-04-06_e97d644d06d759731f445e873a66fdc8_cryptolocker.exe	28
PID 1784 wrote to memory of 2120	1784	2024-04-06_e97d644d06d759731f445e873a66fdc8_cryptolocker.exe	28
PID 1784 wrote to memory of 2120	1784	2024-04-06_e97d644d06d759731f445e873a66fdc8_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-06_e97d644d06d759731f445e873a66fdc8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_e97d644d06d759731f445e873a66fdc8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2120

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
59KB

MD5
1939688a718b712a43f500b5d7d04345

SHA1
af2467404bc6ef1bbe543445690e555315f08fc6

SHA256
63ba313db45c551ced14e1a7f4b8ccb1ddd4fcce2e099735cdaf49645f871b96

SHA512
cfd5880d947103542158821e321e80cb9fe1c0217036a61921b5480cfe573bbb1a394cdd84863b2bac6e1f279f8cef39031e048608e334ee5a3354e2680a8fa7

Download Submit
memory/1784-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1784-1-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1784-4-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2120-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2120-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download