0bf45c7067039474c9422517a9ccb3c97126e9d14b3af018e55673256a53f2a3

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 13:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_712987e5e626f461cd6f4b5051fc2e12_cryptolocker.exe
Size

43KB
MD5

712987e5e626f461cd6f4b5051fc2e12
SHA1

ac5574a3973fa4d27f97534a058cd7de32099a0f
SHA256

0bf45c7067039474c9422517a9ccb3c97126e9d14b3af018e55673256a53f2a3
SHA512

67770e407bc794cc23c84d7eca758548bff90fb0d82979ebc396adfc28c76c180e408b95f46d8ff33777cace50d6f22287c4c64a1748b76422dcd4d9e13c7898
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHuRci:X6QFElP6n+gJQMOtEvwDpjBmzDkWi

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001227c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001227c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2836	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2444	2024-05-22_712987e5e626f461cd6f4b5051fc2e12_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 2836	2444	2024-05-22_712987e5e626f461cd6f4b5051fc2e12_cryptolocker.exe	28
PID 2444 wrote to memory of 2836	2444	2024-05-22_712987e5e626f461cd6f4b5051fc2e12_cryptolocker.exe	28
PID 2444 wrote to memory of 2836	2444	2024-05-22_712987e5e626f461cd6f4b5051fc2e12_cryptolocker.exe	28
PID 2444 wrote to memory of 2836	2444	2024-05-22_712987e5e626f461cd6f4b5051fc2e12_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-22_712987e5e626f461cd6f4b5051fc2e12_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_712987e5e626f461cd6f4b5051fc2e12_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
43KB

MD5
5d8ee02f6d43485e2f0d4f7c0ae996a3

SHA1
f16a86eba47e8283f83008a7b1790c9e3e67e49e

SHA256
a68403bb5c826845985ed7f9fd71088853b8e929438651a4b9f6ee5ea84881d8

SHA512
02004640ae262e57030602c91c9e669a7d7900617859a1c978d4904b8137907a7937797043d68432a63b8d1911e99d0f26268e0a6c396a313cf090b851212ecc

Download Submit
memory/2444-0-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2444-1-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2444-8-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2836-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2836-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download