109a2cc8852f1cfbffa768a903f8c4dd318d958d48279593cb0deb52659712c5

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 21:25

Target

2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe
Size

96KB
MD5

0a1e4e42622155391819251731631769
SHA1

be8daac9a48e49020a68cbd25d6d0b7a9100517c
SHA256

109a2cc8852f1cfbffa768a903f8c4dd318d958d48279593cb0deb52659712c5
SHA512

2b97bdf71cfd16dc8184164763e09b58d7e39f7ca4824afbe7539653860b80a318e24a0b2c1e2e3c3c78feb37d8a7a2f9e0bb2c108a01576d78d101b985512d3
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgpE:V6a+pOtEvwDpjtzP

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2576 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe

pid process

2248 2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2576	asih.exe

pid	process
2248	2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe

description	pid	process	target process
PID 2248 wrote to memory of 2576	2248	2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe	asih.exe
PID 2248 wrote to memory of 2576	2248	2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe	asih.exe
PID 2248 wrote to memory of 2576	2248	2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe	asih.exe
PID 2248 wrote to memory of 2576	2248	2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_0a1e4e42622155391819251731631769_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2576

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
96KB

MD5
febd271ebf9816679b637306e2196e76

SHA1
f8e8a17cfe3efe6a6c85ddbb9ebeb1971d96c530

SHA256
4c4195aac80b1895d20ae12f33af255a9f9ac7c01a6b7bebb6de59a4f3718ab0

SHA512
0e9c8b5c9626bab48819d576f70468aafa77820ec9cce37390f00aebbe6a901657ab20b495811bbb5e91e7534458c090b980e419e2d2c71363fd752e1018b950

Download Submit
memory/2248-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2248-1-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2248-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2576-15-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2576-22-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download