7be442b58f7e3a44a8b40709e9cd8ee1f2ea55e1f6b2e4676baa157bdff38b66

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240319-en
resource tags

arch:x64arch:x86image:win7-20240319-enlocale:en-usos:windows7-x64system
submitted
17/04/2024, 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe
Size

38KB
MD5

599c093fc60f8ebfb2c83d2a8572ceeb
SHA1

4273eab410a394ad051fdb4e159b151d4e64b008
SHA256

7be442b58f7e3a44a8b40709e9cd8ee1f2ea55e1f6b2e4676baa157bdff38b66
SHA512

25646caa75af4d9cd1bafec9b03e98a0a37f1e96f4ade96ef25116078146ba1c93278b5c8d4187f8b11181fc182841f4a048a09e9f90ecaee5b72f02c5090dbb
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkLpz:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkLN

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2876-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000800000001220a-11.dat	CryptoLocker_rule2
behavioral1/memory/2020-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2876-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2876-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000800000001220a-11.dat	CryptoLocker_set1
behavioral1/memory/2020-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2876-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2020	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2020	2876	2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe	28
PID 2876 wrote to memory of 2020	2876	2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe	28
PID 2876 wrote to memory of 2020	2876	2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe	28
PID 2876 wrote to memory of 2020	2876	2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-17_599c093fc60f8ebfb2c83d2a8572ceeb_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
f43e47cb24c5a6a2373498fd4b5029c4

SHA1
207363e6fb45fea404ab860ec6db6cb46f29c0fb

SHA256
39ef5b8db196b34b60f6e8dbef084d3e49b2202bbed6a36dd23f695da2181df7

SHA512
9a2d727b3107c11aa5c90679e84fa490e0abe23d7fa4496d794c986a61a5bfb806e907c4a3ef8e2ac9fc96c6d35f71a183a47e83b5a5a73566d0728308782d98

Download Submit
memory/2020-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2020-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2020-21-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2876-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2876-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2876-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2876-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2876-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download