505969febb9cec947e49b4d4bea4fa37caa65776531b2a89123706f63bbc6adb

Analysis

max time kernel
148s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29/04/2024, 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-29_5ff99995b969d706a524c68045e6c0b8_cryptolocker.exe
Size

51KB
MD5

5ff99995b969d706a524c68045e6c0b8
SHA1

681f4d83be19194e12e2226f101604f4bec122ab
SHA256

505969febb9cec947e49b4d4bea4fa37caa65776531b2a89123706f63bbc6adb
SHA512

126431d507c75de7e1c18c55b1df9ff4c04f4cce1d2b8f6bd8aa67ef70842de081362597f3672dc34a914ee2e9382b039543f10ff2c59b21ec5a618adf564027
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTHGfS:79mqyNhQMOtEvwDpjBxe8GGfS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2696-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d0000000122d1-11.dat	CryptoLocker_rule2
behavioral1/memory/2252-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2696-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2696-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d0000000122d1-11.dat	CryptoLocker_set1
behavioral1/memory/2252-16-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2696-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2252	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2696	2024-04-29_5ff99995b969d706a524c68045e6c0b8_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2696 wrote to memory of 2252	2696	2024-04-29_5ff99995b969d706a524c68045e6c0b8_cryptolocker.exe	28
PID 2696 wrote to memory of 2252	2696	2024-04-29_5ff99995b969d706a524c68045e6c0b8_cryptolocker.exe	28
PID 2696 wrote to memory of 2252	2696	2024-04-29_5ff99995b969d706a524c68045e6c0b8_cryptolocker.exe	28
PID 2696 wrote to memory of 2252	2696	2024-04-29_5ff99995b969d706a524c68045e6c0b8_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-29_5ff99995b969d706a524c68045e6c0b8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_5ff99995b969d706a524c68045e6c0b8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2696
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
51KB

MD5
59f947a41fa620ff6f9a39769e6f7e77

SHA1
42e81a81b015ae78ef99835fe427215c99c44c7a

SHA256
a8cfd02508e37eda91c989fef6fd870ac87829ac1af464c95fbc3b41891c880e

SHA512
145369bebc5bf55bf78181f94ed05c48161132cb6762088d63711073c5e4e653a9b0aa18e4d7eed53039c929157a55afb7c5c81de54416294639415e61379dec

Download Submit
memory/2252-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2252-18-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2252-25-0x00000000003B0000-0x00000000003B6000-memory.dmp

Filesize
24KB

Download
memory/2696-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2696-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2696-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2696-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2696-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download