Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27/05/2024, 13:26
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe
-
Size
39KB
-
MD5
a26034cf81dd1bad7f96d22919cb7247
-
SHA1
01c0280c175a3ad570eb5158e0e8959a1cf48d17
-
SHA256
6f8c704500017e123ec54a6d1cdd72f7fe0f2a56c47758ddd996fe25a9c05815
-
SHA512
2c6453b4c2a68bafb8f7b9d8944373eceb3f1eaca73f4bae6e1d44efa48834c09aaac54aea57c7d765b4c65853714b408385ba0fb7954d84b45af4e0625c10b3
-
SSDEEP
768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFCw0R:X6QFElP6n+gJQMOtEvwDpjBmzDU5R
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b000000016056-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000b000000016056-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2516 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 1932 2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1932 wrote to memory of 2516 1932 2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe 28 PID 1932 wrote to memory of 2516 1932 2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe 28 PID 1932 wrote to memory of 2516 1932 2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe 28 PID 1932 wrote to memory of 2516 1932 2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-27_a26034cf81dd1bad7f96d22919cb7247_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1932 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2516
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5a1311e73f3cda7e0c4d6f48a8eeaf5b4
SHA124b568eda3ff333198b4b1f1d8f427d1bc2570fd
SHA2568ad70783e15453b79ebd0296f6d3397f3a4e2e6666815a923f625c0925e72c10
SHA51231840a12990e503c1679a3e18bb21f9bd0d646959135f3a61a8460a46b484a17838016404cfdabeebe8b629bc266f1ade3fc0bb083b18c3cee87beaa0c36b50e