52ef5fa70ac130b8f07121fbfa649d3c65498eb63d6533012f5aeb99af55ee19

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
04/05/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-04_6a32f77042d924e9b87a558f8a3e9d52_cryptolocker.exe
Size

95KB
MD5

6a32f77042d924e9b87a558f8a3e9d52
SHA1

dc4b2ea5577560c9a6f33b397c6eeedf758e83ac
SHA256

52ef5fa70ac130b8f07121fbfa649d3c65498eb63d6533012f5aeb99af55ee19
SHA512

6487ac5602f11e566d2c65c8e5259b92b0473db1d01515210c14ce38de27ac6755f46aebd7aeb4cb82a475544b95eb2fbdf959e8fcf91f471abaf12bc551746e
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwMg9:V6a+pOtEvwDpjtzh

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000015d0f-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000015d0f-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2160	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1068	2024-05-04_6a32f77042d924e9b87a558f8a3e9d52_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 2160	1068	2024-05-04_6a32f77042d924e9b87a558f8a3e9d52_cryptolocker.exe	28
PID 1068 wrote to memory of 2160	1068	2024-05-04_6a32f77042d924e9b87a558f8a3e9d52_cryptolocker.exe	28
PID 1068 wrote to memory of 2160	1068	2024-05-04_6a32f77042d924e9b87a558f8a3e9d52_cryptolocker.exe	28
PID 1068 wrote to memory of 2160	1068	2024-05-04_6a32f77042d924e9b87a558f8a3e9d52_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-04_6a32f77042d924e9b87a558f8a3e9d52_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_6a32f77042d924e9b87a558f8a3e9d52_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
91d384d7ae8ac2a5c26ed1eb86862f93

SHA1
d89f30abd85a45c3a017562b0822f089f313f449

SHA256
7c607a90bfe3ddf2d936f46963d46b6d13b8dd4dcc38d774ee9450b092419c5e

SHA512
feacf0d57cc102ca2cfdceea97353d74bb14d5f86a3fc9949115fa09e4639ea579423862955e914129a4940253d4175a55c55db2071b26256d234f7e6c2f7f69

Download Submit
memory/1068-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1068-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1068-8-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2160-22-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2160-15-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download