Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe
-
Size
41KB
-
MD5
ebd10ce029ce7aeacfbcf1e59a6cf011
-
SHA1
98ebeb7480514725348bff8f5a40d5d5524eb7f4
-
SHA256
198f14d9e246dae36942f76326a97cc26c01b2d99d90b27ab16b8256335ba1c6
-
SHA512
eacb48a46fd813312a54b33c14cd1be5a7148bde245650042283cca38e1633a2d9685b3c1898204671974654c715f53262ed1894f47054fb3f6df2547bae4c21
-
SSDEEP
768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HK/wSvuQTCjfy:X6QFElP6n+gJQMOtEvwDpjBsYK/f4fy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 2536 asih.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exepid process 2880 2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exedescription pid process target process PID 2880 wrote to memory of 2536 2880 2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe asih.exe PID 2880 wrote to memory of 2536 2880 2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe asih.exe PID 2880 wrote to memory of 2536 2880 2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe asih.exe PID 2880 wrote to memory of 2536 2880 2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ebd10ce029ce7aeacfbcf1e59a6cf011_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\asih.exeFilesize
42KB
MD54c37430fa9d6e884d93e279adb8790e5
SHA1e4b4e68e70c1e6ebe54b43423ae3c06aedbd01db
SHA256477e4a6cb9515a282cabe42c9b2266a5c63dd2fed45be3b779b5f9629a0607a1
SHA512ae9f1a7334670439fb823f9a5601abd65a30d57cc3191e05f216f6ac3a44d4bcc0922936c3a0ba21a00cf6b93e95411d368f8a01a02d3bd910ac1aaf449211e9
-
memory/2536-15-0x0000000000370000-0x0000000000376000-memory.dmpFilesize
24KB
-
memory/2536-22-0x0000000000320000-0x0000000000326000-memory.dmpFilesize
24KB
-
memory/2880-0-0x00000000002D0000-0x00000000002D6000-memory.dmpFilesize
24KB
-
memory/2880-1-0x0000000000470000-0x0000000000476000-memory.dmpFilesize
24KB
-
memory/2880-8-0x00000000002D0000-0x00000000002D6000-memory.dmpFilesize
24KB