e83c4c49a4fdb9f18ad9bb278670da0f85c8563d6266abf9537d0d5774ce9b8a

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
01/05/2024, 04:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-01_5f9758dd9e5b7d5d33964d4bd574fb90_cryptolocker.exe
Size

45KB
MD5

5f9758dd9e5b7d5d33964d4bd574fb90
SHA1

b66ea4f32a605ed5b8dcbd3ed1c273141f8cd178
SHA256

e83c4c49a4fdb9f18ad9bb278670da0f85c8563d6266abf9537d0d5774ce9b8a
SHA512

b51260a095fb153909eb16c646a66dfd2c9585f82edefb47756356cee82056c9346bce9a43438f80f1dc82839bad3ad40af2e578c454f4b507b6816d11984206
SSDEEP

768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAP8:P6QFElP6k+MRQMOtEvwDpjBQpVXl

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2344-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000014230-11.dat	CryptoLocker_rule2
behavioral1/memory/2344-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2092-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2092-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2344-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b000000014230-11.dat	CryptoLocker_set1
behavioral1/memory/2344-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2092-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2092-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2092	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2344	2024-05-01_5f9758dd9e5b7d5d33964d4bd574fb90_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2344 wrote to memory of 2092	2344	2024-05-01_5f9758dd9e5b7d5d33964d4bd574fb90_cryptolocker.exe	28
PID 2344 wrote to memory of 2092	2344	2024-05-01_5f9758dd9e5b7d5d33964d4bd574fb90_cryptolocker.exe	28
PID 2344 wrote to memory of 2092	2344	2024-05-01_5f9758dd9e5b7d5d33964d4bd574fb90_cryptolocker.exe	28
PID 2344 wrote to memory of 2092	2344	2024-05-01_5f9758dd9e5b7d5d33964d4bd574fb90_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-01_5f9758dd9e5b7d5d33964d4bd574fb90_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-01_5f9758dd9e5b7d5d33964d4bd574fb90_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2344
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
fb9fedacfd373f140b6dee27e96c8f75

SHA1
4d1f31a5310c1f7ab60041150595e0ab7a927107

SHA256
50854f0c91fa851d8b303cd415c4900e72eec33e96263b675920a1a7b25d0b68

SHA512
3321acfa8909d9aa9433650abc19c8044664f85f722b8269cf4f66c0c7ee09be0453b94ed1367ef812cc5deb791c038de61e17ed58d38e22810bded4394411bb

Download Submit
memory/2092-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2092-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2092-18-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2092-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2344-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2344-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2344-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2344-9-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2344-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download