f9b8e0ef5f47dad14fe7d3be9282db60460132f0f33f1085b35f8865d5825c66

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/04/2024, 08:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-11_3055f2ba62519643aba6126d21a729c6_cryptolocker.exe
Size

45KB
MD5

3055f2ba62519643aba6126d21a729c6
SHA1

102291446ca686faac821503771def3f771dd9ee
SHA256

f9b8e0ef5f47dad14fe7d3be9282db60460132f0f33f1085b35f8865d5825c66
SHA512

1e6f9e6bdc7bf6ee2382c186a31eade17f479a3cd0c1dbf102bbec01b73a636bfedc4287c43510cd6e984edc10a20fc678ec20440b5d66c749cff776fdf5febe
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCM8CLW2VK:79inqyNR/QtOOtEvwDpjBKccJVODvy33

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1712-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000f00000001225b-11.dat	CryptoLocker_rule2
behavioral1/memory/1712-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2376-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1712-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000f00000001225b-11.dat	CryptoLocker_set1
behavioral1/memory/1712-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2376-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2376	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1712	2024-04-11_3055f2ba62519643aba6126d21a729c6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 2376	1712	2024-04-11_3055f2ba62519643aba6126d21a729c6_cryptolocker.exe	28
PID 1712 wrote to memory of 2376	1712	2024-04-11_3055f2ba62519643aba6126d21a729c6_cryptolocker.exe	28
PID 1712 wrote to memory of 2376	1712	2024-04-11_3055f2ba62519643aba6126d21a729c6_cryptolocker.exe	28
PID 1712 wrote to memory of 2376	1712	2024-04-11_3055f2ba62519643aba6126d21a729c6_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-11_3055f2ba62519643aba6126d21a729c6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_3055f2ba62519643aba6126d21a729c6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
4bf83d94ad1ba8cf0d55dafa403881f9

SHA1
3441bebf83c5e79d0ed6ee0264a6e3a847c2e622

SHA256
40be792ed6bbcefa198dcfb36c02075800809adbc2220573a59fc1e2bae9df33

SHA512
d6bddeb70c708aca511f67d721d092e513a5ba077b4bed24b636e5132848b32000c57e71423a86d2d49873b0f1d3cc7abbbdb5fd185d35ab136a7bdda291b857

Download Submit
memory/1712-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1712-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1712-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1712-4-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1712-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2376-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2376-18-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2376-19-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download