a79668a6d8127cb966c9979bb337c129984ada3b80abdf58e5c91675a053fbb0

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:26

Target

2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe
Size

46KB
MD5

33061337abdca9242ab0de2596275098
SHA1

c589e4d7eb4cab78f7607768fcdd690c5c09350f
SHA256

a79668a6d8127cb966c9979bb337c129984ada3b80abdf58e5c91675a053fbb0
SHA512

895ec61df3fd662c903dcecf300aaad29b695dc397699a55b58410ff9b57137e7cad6240b0709bb57620dc518359dd2612b21ed11759b60d93ee07a0b913949d
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOzzfm0EXsJp:V6QFElP6n+gMQMOtEvwDpjyaYaFAh3M

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

1872 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe

pid process

2988 2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1872	asih.exe

pid	process
2988	2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe

description	pid	process	target process
PID 2988 wrote to memory of 1872	2988	2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe	asih.exe
PID 2988 wrote to memory of 1872	2988	2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe	asih.exe
PID 2988 wrote to memory of 1872	2988	2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe	asih.exe
PID 2988 wrote to memory of 1872	2988	2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_33061337abdca9242ab0de2596275098_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1872

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
5af96bc6ee2dab0e6f06fd80731f417c

SHA1
8e3536d5106b785956a973d94cce8a39bd90b6b9

SHA256
155858089b50d47e3fa4c8bb2c50495fc020cd50a8021888553f3c1356aa4579

SHA512
d711373f12302f274a85eca237ffb21305040e9b511fcfd2d62c3859100db8fb4ea56589adbc5e7c0370cc58a02bf579063b5ab453de7c9e06d76fce7e1d1f27

Download Submit
memory/1872-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1872-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2988-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2988-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2988-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download