c4b854527cfc3a3c8ee25dda0752ff25e54a7e113e1617bd20e4d1a4743828bf

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 20:29

Target

2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe
Size

86KB
MD5

0fb2cc91aa48c933f4bdbb9d9028853b
SHA1

f049155ddfcaf81c6a3fc4e7bc7d128ef7089826
SHA256

c4b854527cfc3a3c8ee25dda0752ff25e54a7e113e1617bd20e4d1a4743828bf
SHA512

679c4f9df26a3ad5657abb1bc0b0cac65a9b88ad59f826792192e2e0ed992bf5336dde5369bfc3a2e6c0694f9508e3097e384866499dfb14fb911bf594d86147
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjyaLccVNl6aL:V6a+pOtEvwDpjvpf

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2796 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe

pid process

2872 2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2796	asih.exe

pid	process
2872	2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe

description	pid	process	target process
PID 2872 wrote to memory of 2796	2872	2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe	asih.exe
PID 2872 wrote to memory of 2796	2872	2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe	asih.exe
PID 2872 wrote to memory of 2796	2872	2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe	asih.exe
PID 2872 wrote to memory of 2796	2872	2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_0fb2cc91aa48c933f4bdbb9d9028853b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2796

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
86KB

MD5
c78d7fb49170f64e411844e5a41c011b

SHA1
0e4a5df2e9a687b98582acb110d4af9c3052f241

SHA256
3d7fd786063dba71a79100e2b7d5a85cf816b426368d5fa9f08ef46ff24e854a

SHA512
3fd9801d7b0f0a140aa859fe8553a050d7973d4352c65e0c71fea76ff394e483aa794d513a37d78b3586eec816f6e99219703719111685ed74d69cefa8ee440a

Download Submit
memory/2796-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2872-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2872-1-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2872-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download