Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
03/06/2024, 10:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe
-
Size
48KB
-
MD5
b059feefd4be7876afc2800ac753c66d
-
SHA1
0258c379107252dab5dce7336821dda9b4d3ff97
-
SHA256
e66008e42ee31205f3f37a7f2e506882b81f1c5b8f5f0a5871c0391f466bd2eb
-
SHA512
3820bb717ab66b6ea9cb025e1753a8fc79ec0a92c157c546aeda2952f37d2191285c212cb8ed0acd7d157d62c5730ae6065e5ed5176f5ab0211fa4cabe857f6f
-
SSDEEP
768:P6LsoVEeegiZPvEhHSP+gp/QtOOtEvwDpjBBMLZdzuqpXsiE8Wq/Dpkcd:P6Q0ElP6G+gJQMOtEvwDpjB8WMlfd
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral1/memory/1804-1-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral1/files/0x000b000000014323-11.dat CryptoLocker_rule2 behavioral1/memory/1804-14-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 behavioral1/memory/3068-24-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 4 IoCs
resource yara_rule behavioral1/memory/1804-1-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral1/files/0x000b000000014323-11.dat CryptoLocker_set1 behavioral1/memory/1804-14-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 behavioral1/memory/3068-24-0x0000000000500000-0x000000000050B000-memory.dmp CryptoLocker_set1 -
Executes dropped EXE 1 IoCs
pid Process 3068 asih.exe -
Loads dropped DLL 1 IoCs
pid Process 1804 2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1804 wrote to memory of 3068 1804 2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe 28 PID 1804 wrote to memory of 3068 1804 2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe 28 PID 1804 wrote to memory of 3068 1804 2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe 28 PID 1804 wrote to memory of 3068 1804 2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_b059feefd4be7876afc2800ac753c66d_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
PID:3068
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5da6af41a571a40bb4a62be7a3509e86d
SHA19a7805c38990bcbe2f90e27fa152ac78c6b3e94f
SHA256709f8c0ae0e28ba86377a855da0dfe561803c1a035a49ab703600dd9cd997d27
SHA5127dedbf349b8bbe7880027bda9e49f335e6cee3005ece8771d11e6601be4c5f6d813528ad34297d64f68e3b37d99447e5d0017a777399012f3b102a6e4c03bed7