24f4e4787a03f402c4c7a636f6ea15b7584ba80bf10a06904c0eb2b4dff0e18a

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe
Size

73KB
MD5

6280b4a510b5a2c3fd055a62b3f419a0
SHA1

ba6b49716e894788d9631db0621213a55949fa49
SHA256

24f4e4787a03f402c4c7a636f6ea15b7584ba80bf10a06904c0eb2b4dff0e18a
SHA512

ca2666a0b8eb9b9e90993b140ac8421a35ebfcd87e38689b9db9b0094fd67b8ce2a27aff30c6d3ff80acf258c2dd2580fc65f8d782964a1cb016bf2484ff097c
SSDEEP

768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsY:u6QFElP6n+gWMOtEvwDpjJGYQbY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

3040 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe

pid process

2420 2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3040	asih.exe

pid	process
2420	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe

description	pid	process	target process
PID 2420 wrote to memory of 3040	2420	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe	asih.exe
PID 2420 wrote to memory of 3040	2420	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe	asih.exe
PID 2420 wrote to memory of 3040	2420	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe	asih.exe
PID 2420 wrote to memory of 3040	2420	2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_6280b4a510b5a2c3fd055a62b3f419a0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2420

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
73KB

MD5
2492ff358f094025f401da2c7e771f9c

SHA1
bb21d5facab90ed6049acada163f34cb5cee4092

SHA256
ab6d0db96b0cc7fa2d1c8f02ca1105413171369f29dbc9c3d487d6c4fbe3fef1

SHA512
bd9e0195a7a72d95582576f15b21340e63d1ebd7f7077b5e915e27f71eed437b1bebe6668116148335712b803bfd475c1452091fc233ff004d597646f3ab03ef

Download Submit
memory/2420-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2420-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2420-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3040-15-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download
memory/3040-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download