8cf6b2770bba4ddeddebd2ea207346c97d13ea77676c2ac5016c3a55cb7ce95d

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 23:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe
Size

52KB
MD5

d7ac91d1af6be97cac7c05f000d6a8e6
SHA1

6d3c7fc8842d49f3963bcbedd50656714797e0b4
SHA256

8cf6b2770bba4ddeddebd2ea207346c97d13ea77676c2ac5016c3a55cb7ce95d
SHA512

458d6e7b16c2f1e5ae37dcabe4903893c6148c9f637d10d678ffa91e73e1a2f19d5a584c3395bbca50110a956e4a2a9ae039a54b15079175710881c35dac0f92
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTCFWpzgVok:X6QFElP6n+gJBMOtEvwDpjBtELVZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2420 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe

pid process

2900 2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2420	asih.exe

pid	process
2900	2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe

description	pid	process	target process
PID 2900 wrote to memory of 2420	2900	2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe	asih.exe
PID 2900 wrote to memory of 2420	2900	2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe	asih.exe
PID 2900 wrote to memory of 2420	2900	2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe	asih.exe
PID 2900 wrote to memory of 2420	2900	2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-26_d7ac91d1af6be97cac7c05f000d6a8e6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2900

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2420

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
52KB

MD5
35146a4cf03e20b0eee2146118345764

SHA1
bf8863e273630b0ed5d3918fc30d8251993d47b6

SHA256
1e224a98a02c6c533145fbae75cc6f381e0c7bc5442cac1370687694a7aebeb7

SHA512
4312cbccc131cc93048694d1ded36ef960d7e63029b0099138ff4d5aecd765272e4dac985645eabfd9495b0be929dd08fad3750b8f5bef1efde04accc5aaebd4

Download Submit
memory/2420-15-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2900-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2900-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2900-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download