bced564c7e51c151b7f085b1245dd1337f24dfd28c7a59279c0270b23ab4ebaf

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 01:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe
Size

74KB
MD5

a7c85f496655c745446f4d14bf246b13
SHA1

75c75e052848e198254eeda2df858df603700ad9
SHA256

bced564c7e51c151b7f085b1245dd1337f24dfd28c7a59279c0270b23ab4ebaf
SHA512

ab45b165599fa40f84df475e6b14ac7f4494ba3fe5c9e9cbdb8cf4081d16fa05987f6cd40941027a5dfc81a0f238841d63f3b8155fd8207d9b31fa665b73699e
SSDEEP

768:u6LsoEEeegiZPvEhHSG+gZgtOOtEvwDpjeY10Y/YMsMYL:u6QFElP6n+gWMOtEvwDpjJGYQb1

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000144ac-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000144ac-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2948	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2360	2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2360 wrote to memory of 2948	2360	2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe	28
PID 2360 wrote to memory of 2948	2360	2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe	28
PID 2360 wrote to memory of 2948	2360	2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe	28
PID 2360 wrote to memory of 2948	2360	2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_a7c85f496655c745446f4d14bf246b13_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2360
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
b7dc8520efd3bb3140d0287e4baee87b

SHA1
3a4b05b6ed0077bf45754e534b952d062ef14d7f

SHA256
0543e8b43dd3e3e783d1606d275b07ddb0aecb17c1ed9098c853f8531c6ed0ce

SHA512
dc052ae52937e867fe0ed529afa627772d13c8c62e6b9448e96620f61f07467d15952ab14d72274b157657c16ae2d4b38b7a45d0e9909cb33ac251075ad0b740

Download Submit
memory/2360-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2360-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2360-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2948-15-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2948-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download