1a8f137e4a74b6ac5531f761345f341f5e66529b865bdca577517c89b4a1e23c

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
09/05/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-09_4aaee7ea85a7504b147948c4c9955219_cryptolocker.exe
Size

85KB
MD5

4aaee7ea85a7504b147948c4c9955219
SHA1

66382964477909bf1c54c845b06ded00130a0f60
SHA256

1a8f137e4a74b6ac5531f761345f341f5e66529b865bdca577517c89b4a1e23c
SHA512

6dba5e43d8d1ac968dd8216f0fed9b5e5b887be6a74b037d8dc36dce34f13ea344b2aa2e17bc54dbbf6fabc38fb675bd865edf3a1e3f495e53d8860fb71f96c2
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNl6a8:V6a+pOtEvwDpjvpI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001269e-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001269e-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2184	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2752	2024-05-09_4aaee7ea85a7504b147948c4c9955219_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2752 wrote to memory of 2184	2752	2024-05-09_4aaee7ea85a7504b147948c4c9955219_cryptolocker.exe	28
PID 2752 wrote to memory of 2184	2752	2024-05-09_4aaee7ea85a7504b147948c4c9955219_cryptolocker.exe	28
PID 2752 wrote to memory of 2184	2752	2024-05-09_4aaee7ea85a7504b147948c4c9955219_cryptolocker.exe	28
PID 2752 wrote to memory of 2184	2752	2024-05-09_4aaee7ea85a7504b147948c4c9955219_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-09_4aaee7ea85a7504b147948c4c9955219_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-09_4aaee7ea85a7504b147948c4c9955219_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2752
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
85KB

MD5
7f9773d37b53902586e44afff5e3543e

SHA1
e63bcd7aec29f29a19dc43dd3ad38b2bf4829960

SHA256
513f8a58539afe7300fa9950b64c9700758a8f2fdf4de37c23185a98a6184050

SHA512
ee6fb887ae5a5809fb1cabd7ad61edb3036859ca5c425cc24e2a740f85c88ddf1b5f875a8643eb2042c26204075c8768f1adaa71f146075404c0969a70bec174

Download Submit
memory/2184-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2184-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2752-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2752-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2752-8-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download