c08d27c297b71056b2b1dab6d40a41706b2fe679b088a7ac617514c96e153585

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 15:26

Target

2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe
Size

46KB
MD5

0c358f89cefb7d6c2517136edc0a3e75
SHA1

51caa37161e3c627dc153aa3c89fd47057621b25
SHA256

c08d27c297b71056b2b1dab6d40a41706b2fe679b088a7ac617514c96e153585
SHA512

1e2d8c877b103b2ba582a98d00f221dc230dddb836a38b42654126c69141d88c61d0615966a1d9841aa3b7c7cfe10d89ef6a3f8d9b40b27b61855f2c4de5a841
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOzzfm0EXsJU:V6QFElP6n+gMQMOtEvwDpjyaYaFAh3x

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2368 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe

pid process

764 2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2368	asih.exe

pid	process
764	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe

description	pid	process	target process
PID 764 wrote to memory of 2368	764	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe	asih.exe
PID 764 wrote to memory of 2368	764	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe	asih.exe
PID 764 wrote to memory of 2368	764	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe	asih.exe
PID 764 wrote to memory of 2368	764	2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_0c358f89cefb7d6c2517136edc0a3e75_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2368

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
36d8f0a6286ccfcee9c192f879cec2de

SHA1
883ae6be89837079ad54ed90fbaad40db5a4dd65

SHA256
17c701d986f2111423e5eab4d9f1d6c1bff7123774c16d282bcab4b97fdf4954

SHA512
2f198ca2e32a3d09c18922a2f935f55b539f2e8dcf587f1fdb0b0d88093079db2b1b58c838b16fe48006069c437a7b8b27eaf4d53e12b5eac82c8ee099564fb1

Download Submit
memory/764-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/764-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/764-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download