6b96892a04e08f8092afedf591217f689be53340c65188203ac7a6c54faf9067

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
02/05/2024, 17:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-02_8b5ff5b8fffc235783fb4c38ce2c929c_cryptolocker.exe
Size

79KB
MD5

8b5ff5b8fffc235783fb4c38ce2c929c
SHA1

36ee19b4a700a3e182dfa6423dd4d5d9077b76fa
SHA256

6b96892a04e08f8092afedf591217f689be53340c65188203ac7a6c54faf9067
SHA512

383c0dc3ab665df66ea19035551bccef732819c51a8430d5347e8b70dc3b0975daf3cb1eb7a86c0811c6be2d9bcf6d1ab052a194688185ac9cf8f5de03ce64b7
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNluiK:V6a+pOtEvwDpjvpQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015c5d-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000015c5d-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2588	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1908	2024-05-02_8b5ff5b8fffc235783fb4c38ce2c929c_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2588	1908	2024-05-02_8b5ff5b8fffc235783fb4c38ce2c929c_cryptolocker.exe	28
PID 1908 wrote to memory of 2588	1908	2024-05-02_8b5ff5b8fffc235783fb4c38ce2c929c_cryptolocker.exe	28
PID 1908 wrote to memory of 2588	1908	2024-05-02_8b5ff5b8fffc235783fb4c38ce2c929c_cryptolocker.exe	28
PID 1908 wrote to memory of 2588	1908	2024-05-02_8b5ff5b8fffc235783fb4c38ce2c929c_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-02_8b5ff5b8fffc235783fb4c38ce2c929c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-02_8b5ff5b8fffc235783fb4c38ce2c929c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
79KB

MD5
aa4c07d5a9fd7d34851dc37e4d99af41

SHA1
1784c40660a0aeac76263ea8b32adf9920d19acf

SHA256
929d99c66b2531f10f0e576c689188a8fd5bdc7964816e90c971df295edb5bf9

SHA512
0211cfc72744920d3a6d743323fd78715b69ad3615a36b8c640c098da6cc9328c60819667f5614e507f4bc2de21d9159951122a177728728f9be40b2f4b444b0

Download Submit
memory/1908-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1908-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1908-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2588-16-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2588-15-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download