82bf2efa7fcc6e579cc53257fc52847a423b9c491ee62d7e699010ded96e5d55

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16/05/2024, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-16_6f3394abaaee7021a87e92e53ee1a7f3_cryptolocker.exe
Size

49KB
MD5

6f3394abaaee7021a87e92e53ee1a7f3
SHA1

9cf8ece1845647bf539cc603c75fb81665027ea4
SHA256

82bf2efa7fcc6e579cc53257fc52847a423b9c491ee62d7e699010ded96e5d55
SHA512

7a10bbb063a32f08d622c3e3a828c59ded7111e264a95c628ee38ecb3d8ffd197cba3aab80719b6090158a131fcdacc09a53744d4865798e38f92ece2d22fca3
SSDEEP

768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkcv:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1640-8-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c0000000167ef-14.dat	CryptoLocker_rule2
behavioral1/memory/2936-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2936-25-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1640-8-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c0000000167ef-14.dat	CryptoLocker_set1
behavioral1/memory/2936-15-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2936-25-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2936	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1640	2024-05-16_6f3394abaaee7021a87e92e53ee1a7f3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2936	1640	2024-05-16_6f3394abaaee7021a87e92e53ee1a7f3_cryptolocker.exe	28
PID 1640 wrote to memory of 2936	1640	2024-05-16_6f3394abaaee7021a87e92e53ee1a7f3_cryptolocker.exe	28
PID 1640 wrote to memory of 2936	1640	2024-05-16_6f3394abaaee7021a87e92e53ee1a7f3_cryptolocker.exe	28
PID 1640 wrote to memory of 2936	1640	2024-05-16_6f3394abaaee7021a87e92e53ee1a7f3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-16_6f3394abaaee7021a87e92e53ee1a7f3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-16_6f3394abaaee7021a87e92e53ee1a7f3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
21ad459243cc8a773c355ebb280f058e

SHA1
a0191a661ecb0008d2f85ec7ac5f1e8a2ee8c0bb

SHA256
1ae9fc0aa1b7bf1d4e8655bfae82c8e7a23a36002f5f809a223a2e38d696687e

SHA512
a258ed65f027d305c9e189e752d88e1900b38f92178a93942b8935525bc21a66ecce200c888749413e3350a895485941d70eec9430e760a6b0736ac290692002

Download Submit
memory/1640-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1640-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1640-8-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1640-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2936-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2936-24-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/2936-17-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2936-25-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download