82ce50d82ac70878a7e49534e5ca43a9cb07b0d5c06c40c947ca57b517143d1f

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
15/04/2024, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-15_240ed63813700bdc5fe9b0b5a7f837f4_cryptolocker.exe
Size

44KB
MD5

240ed63813700bdc5fe9b0b5a7f837f4
SHA1

3abfff3a75bd0c483d88c83424a7d64a0e53f8dd
SHA256

82ce50d82ac70878a7e49534e5ca43a9cb07b0d5c06c40c947ca57b517143d1f
SHA512

0ea9a0b22eb607f465e6e1ac0ece6f464d6eba0392f9801c8c6f57b62dde80654c3d5d06954c0cf9a81802d1c1be55806252eb67094df02bd78249fe24368d7b
SSDEEP

768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPJ:P6QFElP6k+MRQMOtEvwDpjBQpVXY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2372-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2372-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b0000000126ab-14.dat	CryptoLocker_rule2
behavioral1/memory/3068-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3068-25-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2372-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2372-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b0000000126ab-14.dat	CryptoLocker_set1
behavioral1/memory/3068-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3068-25-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3068	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2372	2024-04-15_240ed63813700bdc5fe9b0b5a7f837f4_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3068	2372	2024-04-15_240ed63813700bdc5fe9b0b5a7f837f4_cryptolocker.exe	28
PID 2372 wrote to memory of 3068	2372	2024-04-15_240ed63813700bdc5fe9b0b5a7f837f4_cryptolocker.exe	28
PID 2372 wrote to memory of 3068	2372	2024-04-15_240ed63813700bdc5fe9b0b5a7f837f4_cryptolocker.exe	28
PID 2372 wrote to memory of 3068	2372	2024-04-15_240ed63813700bdc5fe9b0b5a7f837f4_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-15_240ed63813700bdc5fe9b0b5a7f837f4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_240ed63813700bdc5fe9b0b5a7f837f4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
52fe45666d9c86134f51c7b590d1170a

SHA1
d14593034e0304319bdb26609c424b3376f1aeda

SHA256
8fc7aaf73d5203ccf24bebfc9d978669dcb709d56be4816636860739938b7ada

SHA512
ebe073316914061f2ffdc12b625070b40a192b85a0633b924ac4cbbddf70bcfce5d3eaa840c67153f2e7bc9af0e0cd1da671f8e737bfb4d739343e33fdd853bc

Download Submit
memory/2372-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2372-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2372-3-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2372-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2372-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3068-18-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/3068-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/3068-25-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download