9c1de734620ff27a073cb426fcf81bf88dc275a736682069edb90cb5341665eb

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 11:08

Target

2024-04-22_e1f7d105de09865eb758ff3c25432e74_cryptolocker.exe
Size

49KB
MD5

e1f7d105de09865eb758ff3c25432e74
SHA1

06c08dc518b123211619a7a0f8e20090c2df9961
SHA256

9c1de734620ff27a073cb426fcf81bf88dc275a736682069edb90cb5341665eb
SHA512

556a549fee492210872e9950a0ddfc5f2f6c91cfe1932bac0263ccaf91a8fd946150051cb4eb90786d277a9ae389bceecf82b4b6473706fae027e40baad43279
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu55id3AMWZN:X6QFElP6n+gJQMOtEvwDpjB0GIWiWLD

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012251-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012251-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2132	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2960	2024-04-22_e1f7d105de09865eb758ff3c25432e74_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 2132	2960	2024-04-22_e1f7d105de09865eb758ff3c25432e74_cryptolocker.exe	28
PID 2960 wrote to memory of 2132	2960	2024-04-22_e1f7d105de09865eb758ff3c25432e74_cryptolocker.exe	28
PID 2960 wrote to memory of 2132	2960	2024-04-22_e1f7d105de09865eb758ff3c25432e74_cryptolocker.exe	28
PID 2960 wrote to memory of 2132	2960	2024-04-22_e1f7d105de09865eb758ff3c25432e74_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-22_e1f7d105de09865eb758ff3c25432e74_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_e1f7d105de09865eb758ff3c25432e74_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2132

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
c6c6a08af9df39737dd0d104eaff7be9

SHA1
a94a4b5a66300804dd755ad3f576fe2f72d4518e

SHA256
a559e2b3a7fde646e260380d58c22c62a7e05e8186455d44f2624cc02fd9315d

SHA512
09069b3c26bfa17e9713767156ff1c52e43fd3c4ffc4ae6d72b3175a392fcbd4e9e96a4a72bfbaf423a60e78ebf68f44458fad57b458bc3dba7516290e159346

Download Submit
memory/2132-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2132-17-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2960-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2960-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2960-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download