0e48fb479555a08353d87f6a808d031f218255144c763ca85bfcb50198a95b76

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-11_4c88e5d338099a634b95f41453c51c44_cryptolocker.exe
Size

41KB
MD5

4c88e5d338099a634b95f41453c51c44
SHA1

3163aaf07afe8d3f15f2152f7ee503a84c571b34
SHA256

0e48fb479555a08353d87f6a808d031f218255144c763ca85bfcb50198a95b76
SHA512

5778249776adbdf98d3d1a44d6ac44853b9fc51cc4cf3d23d9d8cc18b709e170d3d33675c8244d11e73c5771dd9e12ee54a1d09883d612f950a4d918fa95f3b1
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6WaJIOc+UPPEkL7vF+:YGzl5wjRQBBOsP1QMOtEvwDpjgarrkL8

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1728-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000014454-11.dat	CryptoLocker_rule2
behavioral1/memory/1728-13-0x00000000005F0000-0x00000000005FB000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1728-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1728-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b000000014454-11.dat	CryptoLocker_set1
behavioral1/memory/1728-13-0x00000000005F0000-0x00000000005FB000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1728-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2536	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1728	2024-05-11_4c88e5d338099a634b95f41453c51c44_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2536	1728	2024-05-11_4c88e5d338099a634b95f41453c51c44_cryptolocker.exe	28
PID 1728 wrote to memory of 2536	1728	2024-05-11_4c88e5d338099a634b95f41453c51c44_cryptolocker.exe	28
PID 1728 wrote to memory of 2536	1728	2024-05-11_4c88e5d338099a634b95f41453c51c44_cryptolocker.exe	28
PID 1728 wrote to memory of 2536	1728	2024-05-11_4c88e5d338099a634b95f41453c51c44_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-11_4c88e5d338099a634b95f41453c51c44_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-11_4c88e5d338099a634b95f41453c51c44_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
cd73273842100ac3a735777e9078864b

SHA1
a55ed8bccebb002ccc03474b49419b9d485435ef

SHA256
8471283e092499a1d58eb4ff0dcd9a37e3ac6acf4b6ca658c3a0f63a508b293f

SHA512
0953ecf4c2117f0a7bb8461f39769f55ecdb81221f1adececc7a46df5ca9a214f7e29f5763a98b90d354cdb2bd3f94a852975646a842794cf80c4eb556c76eb0

Download Submit
memory/1728-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1728-1-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1728-2-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1728-3-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1728-13-0x00000000005F0000-0x00000000005FB000-memory.dmp

Filesize
44KB

Download
memory/1728-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download