148c6c8cbf5a414939df7f9d81df4682ecfe5bfc909c8f2b6b3fcbe4e5c527ba

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe
Size

49KB
MD5

28115cef1005bb07c7a103df4ec7ba64
SHA1

2462325d66a22db8c53fbbff94cfb5b4a22456c8
SHA256

148c6c8cbf5a414939df7f9d81df4682ecfe5bfc909c8f2b6b3fcbe4e5c527ba
SHA512

7d67ef1dc72763c9d45952c1c1a728983bced4c567a330d24a4d86402f783eeafa2147df9c525bc51718dc8a8ab172e62aaffeeb5ea768343f6a4c60064389a1
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXfi:X6QFElP6n+gJBMOtEvwDpjBtEdXfi

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

1872 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe

pid process

1688 2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1872	asih.exe

pid	process
1688	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe

description	pid	process	target process
PID 1688 wrote to memory of 1872	1688	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe	asih.exe
PID 1688 wrote to memory of 1872	1688	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe	asih.exe
PID 1688 wrote to memory of 1872	1688	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe	asih.exe
PID 1688 wrote to memory of 1872	1688	2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_28115cef1005bb07c7a103df4ec7ba64_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1688

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
db70a923d3ce59b8a4a2d5c680274320

SHA1
bc0a5a7d840abfe658c16781494a4d631938f6e0

SHA256
0f87502af464ef4fa723c47a3254067a01ef11c2bb9dfdd473e8bd237589a1c8

SHA512
a5f081167b090cb310aa448f3d19bf95a6004a3bac52a74231bd7980aada92bf9f9098706519c80f25a5a97cb790985acb489dda58c90f06b593d38051c59639

Download Submit
memory/1688-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1688-1-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1688-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1872-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1872-22-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download