0db7c75e485f856672e64721a42fc67dd85be0b525a60dbab537a95e6454bef6

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 00:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_2253cff849984f14cccd7b2f462061f2_cryptolocker.exe
Size

64KB
MD5

2253cff849984f14cccd7b2f462061f2
SHA1

9ffbcf2f85281771df4e29370b9b1ec672eef8c0
SHA256

0db7c75e485f856672e64721a42fc67dd85be0b525a60dbab537a95e6454bef6
SHA512

ba33808f7f3a3cac7b330fc7394d9ffd67df0cdb5991195f4dd1b8e2bcea49ebdf907814da267333e1a0e4182b6a6a31b2663da02c0417da2187f32cfbc9ca8f
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLZ/xblzoK:X6a+SOtEvwDpjBrOv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2944	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	2024-04-24_2253cff849984f14cccd7b2f462061f2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2944	2924	2024-04-24_2253cff849984f14cccd7b2f462061f2_cryptolocker.exe	28
PID 2924 wrote to memory of 2944	2924	2024-04-24_2253cff849984f14cccd7b2f462061f2_cryptolocker.exe	28
PID 2924 wrote to memory of 2944	2924	2024-04-24_2253cff849984f14cccd7b2f462061f2_cryptolocker.exe	28
PID 2924 wrote to memory of 2944	2924	2024-04-24_2253cff849984f14cccd7b2f462061f2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-24_2253cff849984f14cccd7b2f462061f2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_2253cff849984f14cccd7b2f462061f2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
19480536c3eb866ffead7d21050ae9c7

SHA1
1c77d274c89cc849157825533b559378308f0e81

SHA256
758ded1d9b4ba22d197c0632629f54c6c125646e7a9cfccb40f7c1d6bce6bc5e

SHA512
7da82454e6589fb894f4bdd5b6f05417bafd14db9c7d949ed8058e3ce949647d4c0a53a7babef6cce44126f3147ba8a4ef1ea09296531572d87f349304cfc8f3

Download Submit
memory/2924-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2924-1-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/2924-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2944-16-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2944-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download