9afc67e6cf1711a20936f1081cd6bf6e27bc2b8bd7c100a0d41e4fa6ee8daf22

Analysis

max time kernel
134s
max time network
164s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07-01-2024 12:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_9ffe725bbf26a12bf9cb97263819952a_cryptolocker.exe
Size

64KB
MD5

9ffe725bbf26a12bf9cb97263819952a
SHA1

1f95ac9f97eafbff437cb85b7d4f38853d5cccee
SHA256

9afc67e6cf1711a20936f1081cd6bf6e27bc2b8bd7c100a0d41e4fa6ee8daf22
SHA512

bd3138ad77c97d9cb3539470641fba79c4e830ea52dc8b69ecb1c3ae3431ad3aeedbea91587f0cf4f1372d3cd179868cee5dcb80bdb9d3c92ee32e3af580b92c
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYjQcsv/:1nK6a+qdOOtEvwDpjD

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2732	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	2024-01-06_9ffe725bbf26a12bf9cb97263819952a_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x000a000000012255-11.dat	upx
behavioral1/memory/2060-12-0x00000000008C0000-0x00000000008D0000-memory.dmp	upx
behavioral1/memory/2060-16-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2732-17-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2732-27-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2732	2060	2024-01-06_9ffe725bbf26a12bf9cb97263819952a_cryptolocker.exe	28
PID 2060 wrote to memory of 2732	2060	2024-01-06_9ffe725bbf26a12bf9cb97263819952a_cryptolocker.exe	28
PID 2060 wrote to memory of 2732	2060	2024-01-06_9ffe725bbf26a12bf9cb97263819952a_cryptolocker.exe	28
PID 2060 wrote to memory of 2732	2060	2024-01-06_9ffe725bbf26a12bf9cb97263819952a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-06_9ffe725bbf26a12bf9cb97263819952a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_9ffe725bbf26a12bf9cb97263819952a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
65KB

MD5
974c6d7afe7ecaf3dc4710a00f3db047

SHA1
fbd384daf9bf741bfba6093b7b6e3d7bf94e96dd

SHA256
a133d0d38f9efc414958e173e17cbb9004aef1cbdcde84d40e13e10307fcf96a

SHA512
072bab435699d09ec2078078ae7eda14ae75b3cdd0a1440d531fcb414ada704931cc2155df5ebd050a9a9105b0bede6f1a37c5942c3fd8893a7c8b7c0baa00c0

Download Submit
memory/2060-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2060-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2060-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2060-4-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2060-12-0x00000000008C0000-0x00000000008D0000-memory.dmp

Filesize
64KB

Download
memory/2060-16-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2732-17-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2732-19-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2732-24-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2732-27-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download