Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
02/06/2024, 05:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe
-
Size
74KB
-
MD5
47cab6f2c0e4d1d29203172259c924e1
-
SHA1
5c827e5263cf85854c6e76e5e096e2a3c3a1db9f
-
SHA256
868045b1eb3aa11dd01ad4e46d7b424782a717475b73abe046953cf583122270
-
SHA512
19968fd8804dfe2fd3a5054db7670ea0c42274da0037e7668354d2110eb2c4e27de763058ce38e9b355e5460443ebc840674a61846dce08f84d5d1c5f32496f7
-
SSDEEP
768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsY:u6QFElP6n+gWMOtEvwDpjJGYQbY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000d00000001226c-10.dat CryptoLocker_rule2 -
Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral1/files/0x000d00000001226c-10.dat CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 2340 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 1284 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1284 wrote to memory of 2340 1284 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe 28 PID 1284 wrote to memory of 2340 1284 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe 28 PID 1284 wrote to memory of 2340 1284 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe 28 PID 1284 wrote to memory of 2340 1284 2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-02_47cab6f2c0e4d1d29203172259c924e1_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:2340
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5d477449fe60aaca20454fa3b9ee9cc95
SHA13696fc2b42162cdac71cb43fe04c46f539ff5cc8
SHA256a814e2acab4a8572dc9c0280f7f4cf3782028daf061bf025bb3f1151f41456e0
SHA51231b40c535467b11b4540df0bf8369adc947da3f61dfc8a205c88c19dddb80530baf3758ab06f59f8a164317097875e091e8a5074f8c6b3ae87ff8f981aaa8d45