1a3eed016f40984e27cd2a6ed46d3316fb9e2885bbe85f4f8be567b03d642f77

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/06/2024, 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-30_63ee7ae0af540dfefecd9cd97526a07d_cryptolocker.exe
Size

78KB
MD5

63ee7ae0af540dfefecd9cd97526a07d
SHA1

37fdb719fd7d23bf71b38a8aac2ab99a1f28a2fb
SHA256

1a3eed016f40984e27cd2a6ed46d3316fb9e2885bbe85f4f8be567b03d642f77
SHA512

bc9cf06048732f453681754ab8dc486bf85c48a387c870f653338b8b8dd6a35dc3c9a6fae18c12846bfef6187aaeb29e11d6f5892017ba99523b10359e3bdc35
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBZYTjipvF2bx1rHsoLktH:X6a+SOtEvwDpjBZYvQd2u

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001226d-13.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001226d-13.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
1648	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1936	2024-06-30_63ee7ae0af540dfefecd9cd97526a07d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 1648	1936	2024-06-30_63ee7ae0af540dfefecd9cd97526a07d_cryptolocker.exe	28
PID 1936 wrote to memory of 1648	1936	2024-06-30_63ee7ae0af540dfefecd9cd97526a07d_cryptolocker.exe	28
PID 1936 wrote to memory of 1648	1936	2024-06-30_63ee7ae0af540dfefecd9cd97526a07d_cryptolocker.exe	28
PID 1936 wrote to memory of 1648	1936	2024-06-30_63ee7ae0af540dfefecd9cd97526a07d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-30_63ee7ae0af540dfefecd9cd97526a07d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-30_63ee7ae0af540dfefecd9cd97526a07d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
79KB

MD5
45d32ec5865c473a0af0e76a11a24735

SHA1
1182a2c7ee1ffba38610cf0d6111623e358df667

SHA256
47752ea5ba26317eb5af891b07653b0de2908cdcc2cbfb5e3d10b9dc0c1c0b69

SHA512
ac63189482107e191de0911c15de091265cbc62561765bb5051cc370d1d86c480105e2763d427011bf053c049d8a9f3f028c431f2848760cb32aa2e2f872abb2

Download Submit
memory/1648-15-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1936-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1936-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/1936-8-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download