adf2760d96bd33e5d9981fde52fa3f5584d35ccc7eef464010ed024b1752ecef

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_519ef2216bebaa43d80437b105e45139_cryptolocker.exe
Size

58KB
MD5

519ef2216bebaa43d80437b105e45139
SHA1

0d7508b04073a22991206f249297690ebfeaceea
SHA256

adf2760d96bd33e5d9981fde52fa3f5584d35ccc7eef464010ed024b1752ecef
SHA512

2fd143383f82b031e930ade15be03eb4706bd55a4bcb6fd2c3ecb8869e3e288dc61635a49792469f625f70b2e602229f2574a13f0b5a2bc703aa31d0528c27dc
SSDEEP

1536:X6QFElP6n+gJBMOtEvwDpjBtE1yILJ0Voq:X6a+BOtEvwDpjBOxq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000153cf-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d0000000153cf-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3064	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2156	2024-04-30_519ef2216bebaa43d80437b105e45139_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2156 wrote to memory of 3064	2156	2024-04-30_519ef2216bebaa43d80437b105e45139_cryptolocker.exe	28
PID 2156 wrote to memory of 3064	2156	2024-04-30_519ef2216bebaa43d80437b105e45139_cryptolocker.exe	28
PID 2156 wrote to memory of 3064	2156	2024-04-30_519ef2216bebaa43d80437b105e45139_cryptolocker.exe	28
PID 2156 wrote to memory of 3064	2156	2024-04-30_519ef2216bebaa43d80437b105e45139_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-30_519ef2216bebaa43d80437b105e45139_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_519ef2216bebaa43d80437b105e45139_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2156
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
1f99432bb53202d838376585a9e9b8ed

SHA1
c2d4e7b39afbf0e7777f6eb857c0b700b9fc1659

SHA256
c362ea7646271418d0225c6fa737321d1a49444f64c4949fc11bbeca9b500327

SHA512
c2d739f392ae548d9effd000d4c8ef8b68d5a0e81684d89a568faba9cd703b1795ab1477f47dc95d362de61facfbff59e2e89a1efe76b4b4252d1083fddf79c8

Download Submit
memory/2156-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2156-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2156-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3064-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download