61d0ddaadec0c7e442db05ea901b2bf0a8f0f75dc3e8fa305c26bc714ef461c8

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
25-05-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_b8c4866d24bc30b0586a850c20c5f544_cryptolocker.exe
Size

53KB
MD5

b8c4866d24bc30b0586a850c20c5f544
SHA1

46e1f194f00c6c983ca02ecfa1c1ca20df6f0f57
SHA256

61d0ddaadec0c7e442db05ea901b2bf0a8f0f75dc3e8fa305c26bc714ef461c8
SHA512

553e2c8611f40940e2bc39c497dbba0141c8bcfca8373951b60103245a9ee94d6dada749d3695bff522a9af99c8416ec0e702203dfac606df5072453f58cdefe
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vxmlcaTIt:X6QFElP6n+gJBMOtEvwDpjBtExmlq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012120-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0007000000012120-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1984	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2256	2024-05-25_b8c4866d24bc30b0586a850c20c5f544_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 1984	2256	2024-05-25_b8c4866d24bc30b0586a850c20c5f544_cryptolocker.exe	28
PID 2256 wrote to memory of 1984	2256	2024-05-25_b8c4866d24bc30b0586a850c20c5f544_cryptolocker.exe	28
PID 2256 wrote to memory of 1984	2256	2024-05-25_b8c4866d24bc30b0586a850c20c5f544_cryptolocker.exe	28
PID 2256 wrote to memory of 1984	2256	2024-05-25_b8c4866d24bc30b0586a850c20c5f544_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-25_b8c4866d24bc30b0586a850c20c5f544_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_b8c4866d24bc30b0586a850c20c5f544_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
53KB

MD5
45d88a40daa7480840929ec1d50de267

SHA1
a90c6bc42fd28a0019088eda43d8c2b902225374

SHA256
437265617e7417c84ae3f0980a5617b1b0d804bb4cc3ff946f9c299faa406511

SHA512
3e34b313b74993ab084081f417feb6667c116277d5d220cdf97b5ec3dfb138e59784961e4dbbfaa80b5a3104a94a68184a2d87842fe1ac2c3f89c3da7a40c54d

Download Submit
memory/1984-15-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1984-22-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2256-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2256-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2256-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download