522212a8f26fd82b92b13730b8f6cef51ec34364854117e339dd180435cded82

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe
Size

76KB
MD5

c133d94f8b116d1acb8e3a3e812e118d
SHA1

f82ad5bf5cd2c833e2facd09b87e12c01bf99e35
SHA256

522212a8f26fd82b92b13730b8f6cef51ec34364854117e339dd180435cded82
SHA512

e758889e990aa39ab4cb7b2fdcac52a26ed79e025cd762448d777cff00b0a38b644e291d0fb3d7824e63fda8126a2bb2ea8e02cb81b5e8d37dc4d2eb3bf9ff82
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHsoLk8:X6a+SOtEvwDpjBZYvQd2r

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3056 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe

pid process

1540 2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3056	asih.exe

pid	process
1540	2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe

description	pid	process	target process
PID 1540 wrote to memory of 3056	1540	2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe	asih.exe
PID 1540 wrote to memory of 3056	1540	2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe	asih.exe
PID 1540 wrote to memory of 3056	1540	2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe	asih.exe
PID 1540 wrote to memory of 3056	1540	2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_c133d94f8b116d1acb8e3a3e812e118d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
76KB

MD5
a18fa96510effa61c5a9f88a528640ce

SHA1
ff43dd177886a68131125512a0bacaf073c16a89

SHA256
71e780fd9d2d5373b9ae6b709df445bc5b4c6c29c376e097175c2019a4d4bdf0

SHA512
84bd7c0deb491dedda8af8a3f4e6a55a0aff0d822cda2475406ab4a8ea5dda635988a56ada23d966a777fed6f8f21d4652d0420f83fc144ee6c9150a62ca4754

Download Submit
memory/1540-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1540-1-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/1540-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3056-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3056-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download