6f555b61a7e4ac9d9d12a93524e18a6f8f92609820f3f53c7e59db0bd6974a48

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 06:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe
Size

51KB
MD5

c176987173c76b0bc646c8d52d663c01
SHA1

a10e2415ddbcc3fa3919c6cfb2b26e35eef1cb03
SHA256

6f555b61a7e4ac9d9d12a93524e18a6f8f92609820f3f53c7e59db0bd6974a48
SHA512

bddf49b27fd15d97b8702e9c5dcd100c64a8b9c2c031aa7541bac05e4758cb5b651de5bbb756ca693ec2d275dbf5ab7c426f9660715041216b9f4f5abe87ad57
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxmlcaTs:X6QFElP6n+gJBMOtEvwDpjBtExmlA

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000144e9-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a0000000144e9-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2640	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2928	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2640	2928	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe	28
PID 2928 wrote to memory of 2640	2928	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe	28
PID 2928 wrote to memory of 2640	2928	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe	28
PID 2928 wrote to memory of 2640	2928	2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_c176987173c76b0bc646c8d52d663c01_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
52KB

MD5
79f54bdd3611a5f424ebbcad8221203c

SHA1
a25e9dbc2d16e6ec1cb7dcc0e01f8b014c28aa47

SHA256
9fa288dd7e0d958453026d45d988a87ad3bfbdb00850e31bdbe76606432e6e40

SHA512
56f4b9af7a6f9a9abd32a5a6cfc5a08d052c2572eb984dbc2df61d9de1379d2bf8be9c5b103d1b4e00575072f9dea1b6c1d71f3e6621d1e5c5526b15cd2f95df

Download Submit
memory/2640-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2640-22-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2928-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2928-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2928-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download