b17b96c8dceeeb1b1d45b0c4d46497926ba5b937eadcb51f8458fb8bf50c2e98

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe
Size

49KB
MD5

1f79ec5c6e0516efd441efb814299c4a
SHA1

db94cd6efb53109df793941d4cc97ad36cb6827c
SHA256

b17b96c8dceeeb1b1d45b0c4d46497926ba5b937eadcb51f8458fb8bf50c2e98
SHA512

187ed3259110b134adfdd335dbf7f189e388b5d36d5de1a0fe9c5ca5944507015e034272dbe036a98c5fee168f2592cbca2fb4ff863763a0e719dc2545ecc5a9
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXf3:X6QFElP6n+gJBMOtEvwDpjBtEdXf3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2360 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe

pid process

2436 2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2360	asih.exe

pid	process
2436	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe

description	pid	process	target process
PID 2436 wrote to memory of 2360	2436	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe	asih.exe
PID 2436 wrote to memory of 2360	2436	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe	asih.exe
PID 2436 wrote to memory of 2360	2436	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe	asih.exe
PID 2436 wrote to memory of 2360	2436	2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_1f79ec5c6e0516efd441efb814299c4a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2436

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2360

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
49KB

MD5
c0e551cbc8e19de40ccb2b5c8ec9cb21

SHA1
257b9d67138cabb43188b49cd0ed68c6b368ab9c

SHA256
6f12cbe9042837ec3c8e6a7692e786dfd464fc9f8775d139e7c00f3d2b532440

SHA512
aede1df294cfa33faceead3143b63f30f40ad353bc94e182eeabc2c1a37ca3d7fd12d0c9cdb1bcf950782c110e10774078d84662fc1d978ed72be4092c975930

Download Submit
memory/2360-15-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2360-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2436-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2436-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2436-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download