58b48c8477ca01d7dabf548eed054d8ffac73c4671eaafc24dfaf08881fabfad

Analysis

max time kernel
148s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/04/2024, 14:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_aa52463a4dbcbf66951983e161cd119f_cryptolocker.exe
Size

39KB
MD5

aa52463a4dbcbf66951983e161cd119f
SHA1

665d8d3740e41debe520a6d1b9e55c72f3d4842f
SHA256

58b48c8477ca01d7dabf548eed054d8ffac73c4671eaafc24dfaf08881fabfad
SHA512

27b8f593565ca96a63bfee3fea4b3e4009601892607d1e27fa82a9c74283e0efd780bd38ea3a41531a4bea4db84dc25b5a06e6c1def5504be5f072358b4239dd
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLNWc:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLN

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1244-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c0000000122fc-11.dat	CryptoLocker_rule2
behavioral1/memory/1244-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2064-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1244-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c0000000122fc-11.dat	CryptoLocker_set1
behavioral1/memory/1244-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2064-17-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2064	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1244	2024-04-16_aa52463a4dbcbf66951983e161cd119f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1244 wrote to memory of 2064	1244	2024-04-16_aa52463a4dbcbf66951983e161cd119f_cryptolocker.exe	28
PID 1244 wrote to memory of 2064	1244	2024-04-16_aa52463a4dbcbf66951983e161cd119f_cryptolocker.exe	28
PID 1244 wrote to memory of 2064	1244	2024-04-16_aa52463a4dbcbf66951983e161cd119f_cryptolocker.exe	28
PID 1244 wrote to memory of 2064	1244	2024-04-16_aa52463a4dbcbf66951983e161cd119f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-16_aa52463a4dbcbf66951983e161cd119f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_aa52463a4dbcbf66951983e161cd119f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1244
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
39KB

MD5
6c73d5fb161fc2622e1b745d445cce9b

SHA1
25d6eafdeb1c2bf0b56e3dfd1ad5f910f3b7f3b3

SHA256
89a91394f4835d13e967ec191bed5000fb912167ed7ce38f421440d537e3f2ab

SHA512
2c962e1b8e8d94d0ee0391229dffe5b6f85874e9c084533bb5ba583688ef46d4490a906b5cb9695986575d282667dd1b7d4fffcc8050bf5e75aaee5b2e15394f

Download Submit
memory/1244-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1244-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1244-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1244-2-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1244-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1244-16-0x0000000001F60000-0x0000000001F6B000-memory.dmp

Filesize
44KB

Download
memory/2064-17-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download