Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    23/04/2024, 23:31

General

  • Target

    2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe

  • Size

    73KB

  • MD5

    b18986a808394c15e18f60e7da792512

  • SHA1

    cd84d2a1974f188fdca29085aa06f3e71523ec6f

  • SHA256

    c1612cf2f706062a25dda9d6fdff2ad2980514e5ca8a539b99ee6d5af170ff14

  • SHA512

    d2cc17b3ffb1d14cb21d33466aa5208cf6d364b197040d42e108ce472298b7ae776aa85335d8d8011651fe4624d163c550b0118a48357907316c16942ce4eab0

  • SSDEEP

    1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1svrt:X6a+SOtEvwDpjBZYvQd28x

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-23_b18986a808394c15e18f60e7da792512_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1956
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2712

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    73KB

    MD5

    aa4e8b67c89f88dd646b8befaa0d52fa

    SHA1

    c5c0f3eabc37dab3eb78006355bcb82bc39e233a

    SHA256

    0ae624386f9a6d087c0e39a8dbbb8fa11ddfa5a04953c1fe3e4eae35639d8706

    SHA512

    3f91ee73ef30fcf7b38e93a4739fc4da51bf9ede53e1d14ef9bcecd73aeaee860ca62abffc0c0f227a6437bb19d2029b707de82df56e7842d50409df99b0fb06

  • memory/1956-0-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/1956-2-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/1956-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2712-15-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2712-17-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB