fa3c073064568c0fd71cff279297f51bb6101a9442ed331243eedacbf283f4ec

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-14_f1c78a0fc497d06c2545f83d30b2d60e_cryptolocker.exe
Size

73KB
MD5

f1c78a0fc497d06c2545f83d30b2d60e
SHA1

8e50e4aae7630cd5928a2caa851504ecdac18bd4
SHA256

fa3c073064568c0fd71cff279297f51bb6101a9442ed331243eedacbf283f4ec
SHA512

a3b7dc156efdf2418e0b66cae8101d576eabdd44f071ff47bd959d5733c36f4b2ab47ae17b6bf3b9d64318810a69a5f5778464e7240ba65f8364e5df18b90093
SSDEEP

768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMse:u6QFElP6n+gWMOtEvwDpjJGYQbe

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012279-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012279-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2444	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2176	2024-05-14_f1c78a0fc497d06c2545f83d30b2d60e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 2444	2176	2024-05-14_f1c78a0fc497d06c2545f83d30b2d60e_cryptolocker.exe	28
PID 2176 wrote to memory of 2444	2176	2024-05-14_f1c78a0fc497d06c2545f83d30b2d60e_cryptolocker.exe	28
PID 2176 wrote to memory of 2444	2176	2024-05-14_f1c78a0fc497d06c2545f83d30b2d60e_cryptolocker.exe	28
PID 2176 wrote to memory of 2444	2176	2024-05-14_f1c78a0fc497d06c2545f83d30b2d60e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-14_f1c78a0fc497d06c2545f83d30b2d60e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-14_f1c78a0fc497d06c2545f83d30b2d60e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
73KB

MD5
4feae3326b4987e2ac661b11415adf46

SHA1
81b22d37b058325202ab28446d4578a1455e6d67

SHA256
9b82290fd0f7d4061ebda041baefefca941a3822929c57eb283014408003a5cb

SHA512
25a5c7ffa295537d5501851a266f10ef0f4c5717ae54cbbc958b9ce79de5627e093cc4921a2a790d256df4e2fc90eac61ae1a40eb4d04d5e6e498f8d5e7eb64b

Download Submit
memory/2176-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2176-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2176-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2444-15-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2444-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download