Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240419-en
  • resource tags

    arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
  • submitted
    26/05/2024, 04:26

General

  • Target

    2024-05-26_6729a0e2d812fdf35d618e89c285348d_cryptolocker.exe

  • Size

    45KB

  • MD5

    6729a0e2d812fdf35d618e89c285348d

  • SHA1

    03b13451f778777d9a581d21077d2960095b2ca6

  • SHA256

    a2e50b25ffd9d8bfea5df9be9407eafffc89bd797acd334e7346a965f141a410

  • SHA512

    dcb31ed55e06037c6d5f1f0a141aa95c4b3978516131c3f401fdf5333177592b4d6b2059e60a69ea0300625e9658f0ceaa7e9cfac04b1a5edcdc80c37a06e151

  • SSDEEP

    768:P6LsoEEeegiZPvEhHS5+Mh/QtOOtEvwDpjBpaD3TUogs/VXpAPT:P6QFElP6k+MRQMOtEvwDpjBQpVX+

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 6 IoCs
  • Detection of Cryptolocker Samples 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_6729a0e2d812fdf35d618e89c285348d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_6729a0e2d812fdf35d618e89c285348d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1516
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2676

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    46KB

    MD5

    7af22f2822f5eba84541093ffdd6956f

    SHA1

    4c8aae2c220e9bc420edeacdba67975e08c42ca8

    SHA256

    89dec282ec75e7fd6e1f5aea8f9ddf5ec57fec030440e123ef7a58e21bc34624

    SHA512

    32fcb576c38899e132698555f07c8a70469d48207083725f1dce425f69c773ce476ef7f3bc609ee72bc32dd72a0242c951f8ef17db4c7334d84058782b9b8496

  • memory/1516-0-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/1516-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/1516-2-0x0000000000210000-0x0000000000216000-memory.dmp

    Filesize

    24KB

  • memory/1516-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

    Filesize

    24KB

  • memory/1516-12-0x0000000001E10000-0x0000000001E1B000-memory.dmp

    Filesize

    44KB

  • memory/1516-16-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2676-17-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB

  • memory/2676-19-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2676-26-0x0000000000500000-0x000000000050B000-memory.dmp

    Filesize

    44KB