060dca9699bf8acbb28878fce7a16d42b8df1ceaddcd25ff5a88cf51439999d7

Analysis

max time kernel
0s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_014fbfebf8de09ef846d5216e9fadcc2_cryptolocker.exe
Size

101KB
MD5

014fbfebf8de09ef846d5216e9fadcc2
SHA1

35329aab0b5a0057aac59a4fd18e9e039ba20891
SHA256

060dca9699bf8acbb28878fce7a16d42b8df1ceaddcd25ff5a88cf51439999d7
SHA512

e8612449155ce4a2b52b079c8672e78621306960a8442c1244f732fe434521f0fb89ff25db3c30e3c629721f1ed8f6a13dce6e8f475e63ed4cc07afa5f0d7075
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpwqWsviP1I:AnBdOOtEvwDpj6zI

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2212	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1972	2024-01-08_014fbfebf8de09ef846d5216e9fadcc2_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1972-15-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x0009000000015f01-25.dat	upx
behavioral1/memory/2212-17-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x0009000000015f01-14.dat	upx
behavioral1/memory/1972-1-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2212-26-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 2212	1972	2024-01-08_014fbfebf8de09ef846d5216e9fadcc2_cryptolocker.exe	15
PID 1972 wrote to memory of 2212	1972	2024-01-08_014fbfebf8de09ef846d5216e9fadcc2_cryptolocker.exe	15
PID 1972 wrote to memory of 2212	1972	2024-01-08_014fbfebf8de09ef846d5216e9fadcc2_cryptolocker.exe	15
PID 1972 wrote to memory of 2212	1972	2024-01-08_014fbfebf8de09ef846d5216e9fadcc2_cryptolocker.exe	15

C:\Users\Admin\AppData\Local\Temp\2024-01-08_014fbfebf8de09ef846d5216e9fadcc2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_014fbfebf8de09ef846d5216e9fadcc2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
101KB

MD5
b94ec678312c465473daccfd4b2b1b85

SHA1
44fdcca993150376da2e1121a52f4344eed82b94

SHA256
98e213959735cc53a7939e699fcc25ded13981b694b8e0feefe8c01841e0f9eb

SHA512
723a8512c1e6146e65a3f12b1303270107386592bc687a2e95d1de169794a749933ea875562b8529b4a1dcab3125d68ba74405fd04b571a8b61ab9518df1358a

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
92KB

MD5
93e516f5d1f166d1c7286e2e044e3550

SHA1
61abe038315a695dc634fe1324dd50a5041e0e6d

SHA256
d7cd1e95bc2fd4b582efe68f87d5b5aabc331b0cbe8619363f732fcfb8260891

SHA512
30edc7379a4da84a0f77cb93dc231f99f75c76d0d8dd71693e318d7f6d554c52833d54c12fcb7a7d426bea9d6dd57e4726032b6be969b061e40cab6d9576cf0b

Download Submit
memory/1972-0-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1972-9-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1972-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1972-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1972-1-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2212-18-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2212-19-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/2212-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2212-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download