bb121a27d41022eac878f5e4bb13b45ac0a7929f2a6983936f094b0a7be05c26

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe
Size

49KB
MD5

aa8aecf88695580566213bd6174ad0d4
SHA1

a462dcc9c22644b34c36676d00c35fe032643d54
SHA256

bb121a27d41022eac878f5e4bb13b45ac0a7929f2a6983936f094b0a7be05c26
SHA512

c68498140381fe523183a021ef5282ee348765baadaa790d558fa0207e54158af83af5e00345c07bf6c3547023ea423add6d0784edb242a11bf0dc2ae9178edd
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vdXf1:X6QFElP6n+gJBMOtEvwDpjBtEdXf1

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2360 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe

pid process

1792 2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2360	asih.exe

pid	process
1792	2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe

description	pid	process	target process
PID 1792 wrote to memory of 2360	1792	2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe	asih.exe
PID 1792 wrote to memory of 2360	1792	2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe	asih.exe
PID 1792 wrote to memory of 2360	1792	2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe	asih.exe
PID 1792 wrote to memory of 2360	1792	2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_aa8aecf88695580566213bd6174ad0d4_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1792

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
8ae9f751087e8a0a6b899afdc1878945

SHA1
01f30c49ee4f0a6f6f94e62d1e848ae3330b8849

SHA256
e9d61b6f0e44efbf9f510c9f10d96d9605dc5f2f65736e885ea4ae676316909d

SHA512
451067d2b5edfb27dd25fe970d04319537af4aefeff9b14628040e7d5a648202213c37982f55d99f660ab02d10b73b1436c7eca531b2aae356f1137a0dc432e4

Download Submit
memory/1792-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1792-1-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/1792-8-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2360-15-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2360-22-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download