Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    03/06/2024, 10:33

General

  • Target

    2024-06-03_7cab398bc4361489fa2d0b19469bc951_cryptolocker.exe

  • Size

    46KB

  • MD5

    7cab398bc4361489fa2d0b19469bc951

  • SHA1

    00bc856cabd48a6738486206b9624ef9e2f36c8a

  • SHA256

    9d530fa85d11af5879f9dc5986b047239493e45e42a136a2c58002ab6e2bbf3c

  • SHA512

    813a5b4d553c91617fe13950410fb3b5b10536fb76981248e9c08ba56e24fb7ea8836f50d0e6c0c958fcfb0ff20b0bbd9ff6c4e1e56627bf5d95f2fd1ff026b8

  • SSDEEP

    768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHuRcD9Y1:X6QFElP6n+gJQMOtEvwDpjBmzDkWDA

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_7cab398bc4361489fa2d0b19469bc951_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_7cab398bc4361489fa2d0b19469bc951_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3040
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2484

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    46KB

    MD5

    ae642f5758662b964aa9b26a59921d4f

    SHA1

    69320cc673a88d30f811cbbad4f69becd911214e

    SHA256

    924a3d653f8ab907d57590bcee278d6cf8f347dee1c85ff02401de706a79c95a

    SHA512

    aa8677a0eac7fdc1d51b0ea1ce117ae7732fc90c13a5ee6ab73c33914ad362874a65721b5c193d34f2f902ce017ac5d97443f629c892f870ca61c1fbf9632f7a

  • memory/2484-15-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2484-22-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/3040-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/3040-1-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/3040-8-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB