Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    11-06-2024 19:30

General

  • Target

    2024-06-11_54ad142bc62175e9b26e879f0be7f33f_cryptolocker.exe

  • Size

    54KB

  • MD5

    54ad142bc62175e9b26e879f0be7f33f

  • SHA1

    8cbca27b0780d8e77b705f36a9963f5998809e16

  • SHA256

    acf98fe6a7e91bdecbb3e7cab22b6be9aa9ff55779e156e6bde7faece1d1bd75

  • SHA512

    c4fb48e7de69e9e07a62260ce923abc52ee8d4f20417568e2436e06ac2ccad3fda74b97283a74551ce07ec807f79ece20f210b151a5e72955557c2a43e9e5f83

  • SSDEEP

    768:79inqyNR/QtOOtEvwDpjBK/rJ+Nw8qn8pKIRszDr6KAH:79mqyNhQMOtEvwDpjBxe8TpXRSDeKQ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_54ad142bc62175e9b26e879f0be7f33f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_54ad142bc62175e9b26e879f0be7f33f_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1920
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    54KB

    MD5

    2ee678ddbc9237b317e92c6c23e036d4

    SHA1

    1dcb6629ab243809dcb59173a3ac2c9c2f846835

    SHA256

    5b055d085917dce1ed8eebcc347d42f6656111224b0ff294d397593406c8da7a

    SHA512

    3b4d770be0526d311a87cc0d1dedbe153e0c4f6d93a13cfccc0fe0ca55779c25d6255d2fd014391572bbfe0b41b8243eef4618031d628d9c8314aaf554c7fc44

  • memory/1920-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/1920-1-0x0000000000440000-0x0000000000446000-memory.dmp

    Filesize

    24KB

  • memory/1920-2-0x0000000000480000-0x0000000000486000-memory.dmp

    Filesize

    24KB

  • memory/1920-9-0x0000000000440000-0x0000000000446000-memory.dmp

    Filesize

    24KB

  • memory/1920-15-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/1964-16-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/1964-18-0x00000000004A0000-0x00000000004A6000-memory.dmp

    Filesize

    24KB

  • memory/1964-25-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB