Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 05:55

General

  • Target

    2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe

  • Size

    41KB

  • MD5

    760288e01cd97fdd69d0dd0b42032462

  • SHA1

    2d68fa468c2a30a2a2020e79497e3306fe194391

  • SHA256

    29a0fd88dd573ec106dafba069064cc298a0047153141aa044d215ca60cf1c4d

  • SHA512

    a6cd4dfbd04464874eebdf62c4413ede6888564d0391b08d0f232327352bece4af318b28815d5bbb7613af24b6b988e36e93020e658e5aebd5971c6b8a8d2f68

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcfr9Or8:X6QFElP6n+gJQMOtEvwDpjBsYK6r0r8

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1800
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2212

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    41KB

    MD5

    ebd54fe98dc2d08c602082a4fd5e706b

    SHA1

    7b0c2388cbb6ddc3b57be41cad5966003a868af9

    SHA256

    afb0d9203f40c05d0f24ead6b35d31284ea4541718546dc999f0f94f49183b81

    SHA512

    a48643687930962cb2deb51bf13b72bc15c6b134cde7cf9f49fecdf22204b0a2fb25e61778dcdbf44cb28ebd50f4dc03da91aeedce99a10acc5fd95a9f28f43e

  • memory/1800-0-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/1800-1-0x00000000004C0000-0x00000000004C6000-memory.dmp

    Filesize

    24KB

  • memory/1800-8-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2212-22-0x0000000000340000-0x0000000000346000-memory.dmp

    Filesize

    24KB

  • memory/2212-15-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB