405ee5eca8ce7836a4c93f374201841396ec421de6323ffe30d895cb4abd99af

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe
Size

86KB
MD5

fc956437a71d3e7f4ee01e6629b09f72
SHA1

3b508a460b674fb670b8e3775838e0b6a811693b
SHA256

405ee5eca8ce7836a4c93f374201841396ec421de6323ffe30d895cb4abd99af
SHA512

f46b328d660aeabdaed0dbd3f818b761d36608015a91a6ed3a98ab4ebc07b040af72a424bc43ebb345545bec9145cd4ab2fb46074c5ce93a0f9c4550629c5871
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNl6a9:V6a+pOtEvwDpjvpp

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2812 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe

pid process

1708 2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2812	asih.exe

pid	process
1708	2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe

description	pid	process	target process
PID 1708 wrote to memory of 2812	1708	2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe	asih.exe
PID 1708 wrote to memory of 2812	1708	2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe	asih.exe
PID 1708 wrote to memory of 2812	1708	2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe	asih.exe
PID 1708 wrote to memory of 2812	1708	2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_fc956437a71d3e7f4ee01e6629b09f72_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
86KB

MD5
301301d3f117d03575fb0ff102775b6b

SHA1
398c0dab5cfe460445b58d7c6281ea0005818baa

SHA256
63e5a5d118d374092bbf360a428db9fae3585318eeb8e7e40917eaafaf2bd8ef

SHA512
97600ac66573c64dbe6a99a1ca776aba98a0f10e982af0062ea280d7b1b0f3d3dd8f3af4437143d02ed5b363820acbb4ee029928b6857e2b0d998a2d11b9ebc0

Download Submit
memory/1708-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1708-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1708-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2812-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2812-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download