ab6f81a047692b79176a586e29b57240b736f9e6f9ba665cb67b167a6a85479d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26/04/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-26_9a323ef5257776e807294944ac1eddf7_cryptolocker.exe
Size

95KB
MD5

9a323ef5257776e807294944ac1eddf7
SHA1

063805eea972ded88f627764e973aa0abe66bcc1
SHA256

ab6f81a047692b79176a586e29b57240b736f9e6f9ba665cb67b167a6a85479d
SHA512

9db6da73b914ba9029a41d3961bc43ba7747031cf0ab3b6ed2c1f141d5055d561bf2b3278615c92b6400e0a143834f04a0f398a8bde6460507459dd2b178d541
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgp0c:V6a+pOtEvwDpjtzk

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012256-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012256-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2596	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2588	2024-04-26_9a323ef5257776e807294944ac1eddf7_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2596	2588	2024-04-26_9a323ef5257776e807294944ac1eddf7_cryptolocker.exe	28
PID 2588 wrote to memory of 2596	2588	2024-04-26_9a323ef5257776e807294944ac1eddf7_cryptolocker.exe	28
PID 2588 wrote to memory of 2596	2588	2024-04-26_9a323ef5257776e807294944ac1eddf7_cryptolocker.exe	28
PID 2588 wrote to memory of 2596	2588	2024-04-26_9a323ef5257776e807294944ac1eddf7_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-26_9a323ef5257776e807294944ac1eddf7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-26_9a323ef5257776e807294944ac1eddf7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
ef409bb4fdb8ceac8a08b6a2487826ea

SHA1
ebf7aa73f5c8dd290c3a2302825674dfa55a1680

SHA256
898f00a745d65770126aed54aac6d63482fc74fee6a213eadc4a910af2c67f8d

SHA512
c6637221b0353d5140eb929bd89dcace17f61c7dbf1bb5f0380ab22ee793d3344bf40be29a9f3024e60db36d3638ce0603c5bf97540339b0742aba822dddff55

Download Submit
memory/2588-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2588-2-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2588-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2596-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2596-19-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download