cdc8f93149512ceffcd4891561ff0cc25842f46e442486bb6968396280bcefd6

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
11-05-2024 18:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-11_00626f19c3d17c690997db0ba19f4b34_cryptolocker.exe
Size

51KB
MD5

00626f19c3d17c690997db0ba19f4b34
SHA1

b58d065b0e18eb2f5b7c5a62e30dfb90c1b871f3
SHA256

cdc8f93149512ceffcd4891561ff0cc25842f46e442486bb6968396280bcefd6
SHA512

ca3ebe31e39db809b4acd89619da6cb4bd58089b22fb3ea3f8911913a93093cc0e613a7890b45809b74f19874d4c6b7afe9637bd72a39c6b72db5d70fda2560c
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qnTHGf04O:79mqyNhQMOtEvwDpjBxe8GGfi

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral1/memory/2052-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d000000012279-11.dat	CryptoLocker_rule2
behavioral1/memory/2052-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral1/memory/2052-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d000000012279-11.dat	CryptoLocker_set1
behavioral1/memory/2052-15-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2752	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2052	2024-05-11_00626f19c3d17c690997db0ba19f4b34_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2052 wrote to memory of 2752	2052	2024-05-11_00626f19c3d17c690997db0ba19f4b34_cryptolocker.exe	28
PID 2052 wrote to memory of 2752	2052	2024-05-11_00626f19c3d17c690997db0ba19f4b34_cryptolocker.exe	28
PID 2052 wrote to memory of 2752	2052	2024-05-11_00626f19c3d17c690997db0ba19f4b34_cryptolocker.exe	28
PID 2052 wrote to memory of 2752	2052	2024-05-11_00626f19c3d17c690997db0ba19f4b34_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-11_00626f19c3d17c690997db0ba19f4b34_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-11_00626f19c3d17c690997db0ba19f4b34_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2052
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
51KB

MD5
3358aea7d0414b7ea2c1a9847bb14f03

SHA1
e3777424a915d0164fa27fa7f5ea736e35c13f0d

SHA256
b614d61c5fe412e66e0e31f8e146b2173ece834c59c2ea260b0680ca2b0a8834

SHA512
0a58fc6b1abf456fd2466867c3b003f1cf375022fd6ffc2b2b29e62d22b7bbb4368055ba06ab2a6c3f9aedea4d0b9a76aff68531ff6654bd2a28153d83296f59

Download Submit
memory/2052-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2052-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2052-9-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2052-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2052-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2752-17-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2752-24-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download