306792612604d52770d50281423f6d92c8828df3489987885b8582217dd7b133

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
17-05-2024 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-17_533eab20f14365cacaeade3dcbf5c1c5_cryptolocker.exe
Size

48KB
MD5

533eab20f14365cacaeade3dcbf5c1c5
SHA1

d9196154d6069364b456f5a49eb6b6728898a3d4
SHA256

306792612604d52770d50281423f6d92c8828df3489987885b8582217dd7b133
SHA512

d85f367c9e7fdeb3fbb8d0deef37228538778b32e7c71bf4a99075707132ad028c38e5ad7e6550c4a928fe9c0ffe9c7f2fccead9f08b9cb9224a951ac0d88c7a
SSDEEP

768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/DpkclM:P6Q0ElP6G+gJQMOtEvwDpjB8WMlflM

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a000000015cb1-11.dat	CryptoLocker_rule2
behavioral1/memory/2172-13-0x0000000000630000-0x000000000063B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2172-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2544-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2172-0-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000a000000015cb1-11.dat	CryptoLocker_set1
behavioral1/memory/2172-13-0x0000000000630000-0x000000000063B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2172-16-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2544-26-0x0000000000500000-0x000000000050B000-memory.dmp	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2544	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2172	2024-05-17_533eab20f14365cacaeade3dcbf5c1c5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2544	2172	2024-05-17_533eab20f14365cacaeade3dcbf5c1c5_cryptolocker.exe	28
PID 2172 wrote to memory of 2544	2172	2024-05-17_533eab20f14365cacaeade3dcbf5c1c5_cryptolocker.exe	28
PID 2172 wrote to memory of 2544	2172	2024-05-17_533eab20f14365cacaeade3dcbf5c1c5_cryptolocker.exe	28
PID 2172 wrote to memory of 2544	2172	2024-05-17_533eab20f14365cacaeade3dcbf5c1c5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-17_533eab20f14365cacaeade3dcbf5c1c5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-17_533eab20f14365cacaeade3dcbf5c1c5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
4e23e34d99f1652af412e20b4c18e66b

SHA1
e35e1e2f86926eb2775de344421f0dfb60453527

SHA256
ed1232501a4b8254c64839f7b0569c43933ae02accbe07232ae17e2d48c717de

SHA512
133b357643ab17a9794ecae314524fdf0be773337dfbc784b34692b72bb8ef4178a53215062865887712d5a388916a06a5c19b2cfdc81501689cb3e310cb72fe

Download Submit
memory/2172-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2172-2-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2172-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2172-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2172-13-0x0000000000630000-0x000000000063B000-memory.dmp

Filesize
44KB

Download
memory/2172-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2544-18-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2544-26-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2544-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download