02ade50ca765b4d734ba94088ebe6c5ee5ffe0e77503040961330208f59f3c23

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
03/06/2024, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe
Size

46KB
MD5

78ef9eda0250340e7456a5e6d360a763
SHA1

9c9a9e76c4dd8325231f4933d11ff72160eb69ff
SHA256

02ade50ca765b4d734ba94088ebe6c5ee5ffe0e77503040961330208f59f3c23
SHA512

735e63a083051539352742bf58289f7607fb275c0017699a1d2836985f923682fc2aa4d1c48d6a1a73e1d71edc250ac29315612affd55cb208ddde734eaef858
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHuRcD9V:X6QFElP6n+gJQMOtEvwDpjBmzDkWDv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001228a-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001228a-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3024	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1180	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 3024	1180	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe	28
PID 1180 wrote to memory of 3024	1180	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe	28
PID 1180 wrote to memory of 3024	1180	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe	28
PID 1180 wrote to memory of 3024	1180	2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_78ef9eda0250340e7456a5e6d360a763_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
493ce783cac27fa80a6b13e4404b33b8

SHA1
68cafaaea9702f34e4de5a7eb5fc17ecfa440791

SHA256
91f9aa68db235c128723ec8b35954071d5fe1c047fcf6869bd8c08fde3c1e3ca

SHA512
b47dfdecb4083ef0f0124b3425b2ac4a0008a477602714ade800d9914b1342f2f6f7244387db7361a0524d2af46dc678525239548a98db2b66fbe3b458159989

Download Submit
memory/1180-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1180-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1180-8-0x0000000077740000-0x00000000778E9000-memory.dmp

Filesize
1.7MB

Download
memory/3024-15-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/3024-22-0x0000000077740000-0x00000000778E9000-memory.dmp

Filesize
1.7MB

Download