7ebc25e6f044f00839b0174cbb4fcd0269e5054710a14f1202ace64cfdf564f3

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22/05/2024, 14:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_a6aa9a8414e644384e0357d8653d3fc5_cryptolocker.exe
Size

73KB
MD5

a6aa9a8414e644384e0357d8653d3fc5
SHA1

617a4ad121487bdbb59c540b5fcf8fccd93d33cb
SHA256

7ebc25e6f044f00839b0174cbb4fcd0269e5054710a14f1202ace64cfdf564f3
SHA512

3cd942afb4bd455c0e23d748bb566639dd8ff68c04c9ed921d521072146a0d99e60c5247c30de87a991b23e62718da995a0bece70d54c1c72480363651b8554d
SSDEEP

768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsU:u6QFElP6n+gWMOtEvwDpjJGYQbU

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000015c85-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000015c85-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2948	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2832	2024-05-22_a6aa9a8414e644384e0357d8653d3fc5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 2948	2832	2024-05-22_a6aa9a8414e644384e0357d8653d3fc5_cryptolocker.exe	28
PID 2832 wrote to memory of 2948	2832	2024-05-22_a6aa9a8414e644384e0357d8653d3fc5_cryptolocker.exe	28
PID 2832 wrote to memory of 2948	2832	2024-05-22_a6aa9a8414e644384e0357d8653d3fc5_cryptolocker.exe	28
PID 2832 wrote to memory of 2948	2832	2024-05-22_a6aa9a8414e644384e0357d8653d3fc5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-22_a6aa9a8414e644384e0357d8653d3fc5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_a6aa9a8414e644384e0357d8653d3fc5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
71e7cec1a47ec48d9e3abff20fdb64ba

SHA1
07708a9186b1a7499156d8b2dae79e825ff69c3f

SHA256
b81e3b2069ede9e60b355fbe79b162c4342f0c91eca02dcc597c2c3037186c7b

SHA512
644022c8a921a6d7b1f97e9d91a3503dc2e674ee625901d7054d55eb6a97e12bf84ff30b7f4f8c70f7b5eff7efd7823852598d645c58d7100a492242712f356d

Download Submit
memory/2832-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2832-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2832-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2948-22-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2948-15-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download