bbb3db5be8caefdfe725c242454c85926132159f8c0a5e60b97d33af964161f7

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 09:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_d17f7f5d763dc3918c4c01f559594992_cryptolocker.exe
Size

40KB
MD5

d17f7f5d763dc3918c4c01f559594992
SHA1

921d549faef71696af3ef6ca280fb70ae047dc05
SHA256

bbb3db5be8caefdfe725c242454c85926132159f8c0a5e60b97d33af964161f7
SHA512

c452d4046a1dfed21fdd7ef90a5359227d07602eaa3466976516aefbd34ad4d2510456da4aee8478353be097d1c035918338592956d94eeeafb6fb5898007624
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaac4HKcfrq3:X6QFElP6n+gJQMOtEvwDpjBsYK6r6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001231c-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001231c-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2580	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2700	2024-05-25_d17f7f5d763dc3918c4c01f559594992_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 2580	2700	2024-05-25_d17f7f5d763dc3918c4c01f559594992_cryptolocker.exe	28
PID 2700 wrote to memory of 2580	2700	2024-05-25_d17f7f5d763dc3918c4c01f559594992_cryptolocker.exe	28
PID 2700 wrote to memory of 2580	2700	2024-05-25_d17f7f5d763dc3918c4c01f559594992_cryptolocker.exe	28
PID 2700 wrote to memory of 2580	2700	2024-05-25_d17f7f5d763dc3918c4c01f559594992_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-25_d17f7f5d763dc3918c4c01f559594992_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_d17f7f5d763dc3918c4c01f559594992_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
8a9833f49ea87c0b9dbf878ca7ac7c5d

SHA1
c04fdad344142623744eabbb8fd546eb7f2c3f36

SHA256
312d68886f37a90a191c8a7a33133beeefb08022989de59246adf80fcfe7cc8a

SHA512
c62c065f19f9fec332071347c8e3acf335c0637a37a8f5fcc908121fc7bf71bdf00086ee164bcb31c91c0a6e66035c72cc46bf0d6e65d1312ab13b4df2c4882b

Download Submit
memory/2580-22-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2580-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2700-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2700-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2700-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download