cc874fd99203d21926ec3af8007a35c2e9e35a452a5c301f8e22251bbffb1f35

Analysis

max time kernel
149s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_544f41b36f1f3223ea348a8b807958d7_cryptolocker.exe
Size

55KB
MD5

544f41b36f1f3223ea348a8b807958d7
SHA1

09c09a3ca5eceedde86a73b1709e250b91140330
SHA256

cc874fd99203d21926ec3af8007a35c2e9e35a452a5c301f8e22251bbffb1f35
SHA512

4f4e0377ff4c055b5551c2e6acf504253a53f71305c252e38fdfa456a37282044036f8b22f8c63a766e3ac80b690cc4b8f6765369e93a92eefe2279b42dc5efc
SSDEEP

768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5axzY22m:z6QFElP6n+gKmddpMOtEvwDpj9aYalv

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2192	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
824	2024-01-06_544f41b36f1f3223ea348a8b807958d7_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2192-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000c0000000122f0-14.dat	upx
behavioral1/memory/824-8-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2192-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 2192	824	2024-01-06_544f41b36f1f3223ea348a8b807958d7_cryptolocker.exe	16
PID 824 wrote to memory of 2192	824	2024-01-06_544f41b36f1f3223ea348a8b807958d7_cryptolocker.exe	16
PID 824 wrote to memory of 2192	824	2024-01-06_544f41b36f1f3223ea348a8b807958d7_cryptolocker.exe	16
PID 824 wrote to memory of 2192	824	2024-01-06_544f41b36f1f3223ea348a8b807958d7_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-06_544f41b36f1f3223ea348a8b807958d7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_544f41b36f1f3223ea348a8b807958d7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:824
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/824-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/824-15-0x00000000006C0000-0x00000000006D0000-memory.dmp

Filesize
64KB

Download
memory/824-8-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/824-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/824-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/824-26-0x00000000006C0000-0x00000000006D0000-memory.dmp

Filesize
64KB

Download
memory/2192-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2192-19-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2192-18-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2192-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download