7614be8f6312b32d89e10a472558db2927295ba57cd1d03f5bf7c40a3d521fd5

Analysis

max time kernel
147s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
13/06/2024, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-13_268a7b06bc32f7a2d1d510950fb4ae33_cryptolocker.exe
Size

76KB
MD5

268a7b06bc32f7a2d1d510950fb4ae33
SHA1

31bcf7239924832447d2027c5a171896fd5b819a
SHA256

7614be8f6312b32d89e10a472558db2927295ba57cd1d03f5bf7c40a3d521fd5
SHA512

9cb3c7c8e08cc673ff609fd9e926f3903a5d389db3d8fba4df8eb65dcb902553ef0ef8d35423062482d66e5910086e6b263dc952a9eef703c3955b35003e7213
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHsS:X6a+SOtEvwDpjBZYvQd2p

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000f00000001226b-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000f00000001226b-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
3040	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1960	2024-06-13_268a7b06bc32f7a2d1d510950fb4ae33_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 3040	1960	2024-06-13_268a7b06bc32f7a2d1d510950fb4ae33_cryptolocker.exe	28
PID 1960 wrote to memory of 3040	1960	2024-06-13_268a7b06bc32f7a2d1d510950fb4ae33_cryptolocker.exe	28
PID 1960 wrote to memory of 3040	1960	2024-06-13_268a7b06bc32f7a2d1d510950fb4ae33_cryptolocker.exe	28
PID 1960 wrote to memory of 3040	1960	2024-06-13_268a7b06bc32f7a2d1d510950fb4ae33_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-13_268a7b06bc32f7a2d1d510950fb4ae33_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_268a7b06bc32f7a2d1d510950fb4ae33_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
76KB

MD5
fae4760ad0e1448a779503268fe37325

SHA1
01927c1d59e4328fad62edc1b03122d36c9bc739

SHA256
6734bad429479aa7da2becae35d268627f932831fadd6649f3cd39df95a7e943

SHA512
72e082273f7395a2e938248e637bedb79061de2f01a035831716ae4fa65528e4062e21ccaab0a36c62ae5519b4f0fd9e336b39ff3f95bd720ec6bcdee4c8de92

Download Submit
memory/1960-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1960-1-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1960-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3040-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download