161f238f9e1e1da86ab4107471140532e27bab2e0d1b1410ee362eb1c00de5c3

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
07-06-2024 13:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-07_13d4d247f5acf100545db793a0ac8868_cryptolocker.exe
Size

45KB
MD5

13d4d247f5acf100545db793a0ac8868
SHA1

b9f31a8c3a2bf84836603a8d781e25836f668d05
SHA256

161f238f9e1e1da86ab4107471140532e27bab2e0d1b1410ee362eb1c00de5c3
SHA512

00f64b37ad00002a341d0954531f57c0a15ece7addbd97147b3e24d2ffa8360a3c0650e319d77410f52c378fd597cef067a8b3e3b75f177a76d018441f17b4ad
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBVaD3TP7DFHuRcD9HjA:X6QFElP6n+gJQMOtEvwDpjBmzDkWDtk

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012336-21.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012336-21.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2544	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2092	2024-06-07_13d4d247f5acf100545db793a0ac8868_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 2544	2092	2024-06-07_13d4d247f5acf100545db793a0ac8868_cryptolocker.exe	28
PID 2092 wrote to memory of 2544	2092	2024-06-07_13d4d247f5acf100545db793a0ac8868_cryptolocker.exe	28
PID 2092 wrote to memory of 2544	2092	2024-06-07_13d4d247f5acf100545db793a0ac8868_cryptolocker.exe	28
PID 2092 wrote to memory of 2544	2092	2024-06-07_13d4d247f5acf100545db793a0ac8868_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-07_13d4d247f5acf100545db793a0ac8868_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-07_13d4d247f5acf100545db793a0ac8868_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
dadfa471cffcea10c6df737a0ec4c405

SHA1
dca37d3b7e81b5550fec2d5a1e8480f1e5933694

SHA256
29f1ce54682d2c464048615497ff2c098e08c5f8bb061913c6569db6a173934d

SHA512
1ad245970f7c70daafe773951a6e95910f8402b55fc4694f151ef38cb154b14d0a091e33fd66f89ae667b3a5d4f44dcfeaf7bb0962c711a62456195fca89a4a8

Download Submit
memory/2092-0-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2092-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2092-8-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2544-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2544-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download