Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe
-
Size
85KB
-
MD5
638f4cb3f54e9189db0e4a63a8ec76c5
-
SHA1
cc1fa3211e0d946ee93c2bfa60c56209e751f551
-
SHA256
d309c66f74e56e6c98ac0b2f105f1ab47f26d2b3a72348682ca09f8fea31d501
-
SHA512
b70dd307712c2f41c9cf0bf8eb7846cf6ddb9d970c9cb2d5340ef44720c8b3332783f8d7b1ee04495e88123b88524103ebfdb0a714267c196695b6429eb29e78
-
SSDEEP
1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNl6ax:V6a+pOtEvwDpjvpl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 2528 asih.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exepid process 2324 2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exedescription pid process target process PID 2324 wrote to memory of 2528 2324 2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe asih.exe PID 2324 wrote to memory of 2528 2324 2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe asih.exe PID 2324 wrote to memory of 2528 2324 2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe asih.exe PID 2324 wrote to memory of 2528 2324 2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_638f4cb3f54e9189db0e4a63a8ec76c5_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2528
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\asih.exeFilesize
85KB
MD51bdee7b663e92607449d9409b2fa63fd
SHA1de1c51b7f5ef81c1cc95bb54795a84a7b0d9d00f
SHA256330220d40d69e67a2808c0fff1727e717c9c1139f50eba35a3f10d189271b080
SHA51298941ee669e8b9fdf88647959cccedcca0a5f83b9190ace95b78000c103deb5e2d4d3ef348325e4a6ae002bf91ac07c49891862ecc611b822f8a17d3404a3a2f
-
memory/2324-0-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/2324-1-0x0000000000210000-0x0000000000216000-memory.dmpFilesize
24KB
-
memory/2324-8-0x00000000001D0000-0x00000000001D6000-memory.dmpFilesize
24KB
-
memory/2528-15-0x0000000000460000-0x0000000000466000-memory.dmpFilesize
24KB
-
memory/2528-22-0x0000000000420000-0x0000000000426000-memory.dmpFilesize
24KB