9c0e2f17469c885c99d41ce5cad875133f439e8605b6595fe2a4ed2c4442c98f

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe
Size

60KB
MD5

cedd4166f731ba98f69e48cf14477fa1
SHA1

331fd4d37296dd86ce502b4cd50cd04d275b4f7e
SHA256

9c0e2f17469c885c99d41ce5cad875133f439e8605b6595fe2a4ed2c4442c98f
SHA512

0f3c16b00e12ea9e1f484747d3d635348388ecb8df25e4b77e7c7d21055e7f75d1507aea7e7eacc5c2097425c10ffc2000648e2b0da3d4ff925bc86418c6ed2f
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVCbtCK:V6a+pOtEvwDpjv0

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000015ccd-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000015ccd-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2036	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2776	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2036	2776	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe	28
PID 2776 wrote to memory of 2036	2776	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe	28
PID 2776 wrote to memory of 2036	2776	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe	28
PID 2776 wrote to memory of 2036	2776	2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_cedd4166f731ba98f69e48cf14477fa1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
60KB

MD5
01be41e9fce7837440cf5432b6a0ccac

SHA1
76a1ecfe4ad19de527276e1b201443427361ce35

SHA256
d0e6bc553e1357b3d94614aa1615ebcdbbd9cf182a0acf45a8ca12a6c6c6a31f

SHA512
d6b6a70d7773ce0b764a9f7069e94e8b2a035c8b4ad64b04551ce0c8ccefc802cd6f9d6ee5a690123d4f8f9616d98966bb3aa3d669c980a7e6ab20cf8e9704f2

Download Submit
memory/2036-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2036-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2776-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2776-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2776-8-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download