Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 05:55
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe
-
Size
41KB
-
MD5
760288e01cd97fdd69d0dd0b42032462
-
SHA1
2d68fa468c2a30a2a2020e79497e3306fe194391
-
SHA256
29a0fd88dd573ec106dafba069064cc298a0047153141aa044d215ca60cf1c4d
-
SHA512
a6cd4dfbd04464874eebdf62c4413ede6888564d0391b08d0f232327352bece4af318b28815d5bbb7613af24b6b988e36e93020e658e5aebd5971c6b8a8d2f68
-
SSDEEP
768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcfr9Or8:X6QFElP6n+gJQMOtEvwDpjBsYK6r0r8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000d000000014713-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000d000000014713-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2212 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 1800 2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2212 1800 2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe 28 PID 1800 wrote to memory of 2212 1800 2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe 28 PID 1800 wrote to memory of 2212 1800 2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe 28 PID 1800 wrote to memory of 2212 1800 2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_760288e01cd97fdd69d0dd0b42032462_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2212
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5ebd54fe98dc2d08c602082a4fd5e706b
SHA17b0c2388cbb6ddc3b57be41cad5966003a868af9
SHA256afb0d9203f40c05d0f24ead6b35d31284ea4541718546dc999f0f94f49183b81
SHA512a48643687930962cb2deb51bf13b72bc15c6b134cde7cf9f49fecdf22204b0a2fb25e61778dcdbf44cb28ebd50f4dc03da91aeedce99a10acc5fd95a9f28f43e