68ea744c4f1c5b5bd11a2e0d9ab3e521211d0669e7a6264ee979b92bb2498657

Analysis

max time kernel
148s
max time network
136s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_45e34a968ff2926a976d52f2903c9736_cryptolocker.exe
Size

91KB
MD5

45e34a968ff2926a976d52f2903c9736
SHA1

29510ec0cf8d588ab34415a5d43fa579abe3c7e2
SHA256

68ea744c4f1c5b5bd11a2e0d9ab3e521211d0669e7a6264ee979b92bb2498657
SHA512

2f7ef8db2fc249c65735c6e04697442e37dd3f691e4ab0411b503231a09b91e3a5e7c02d74d306f1a5cb6f30bfaad436c1fa3d3c4f4fd7a556375e4758407b68
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp01l:AnBdOOtEvwDpj6zn

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2960	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2904	2024-01-08_45e34a968ff2926a976d52f2903c9736_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2904-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000a000000013a1a-11.dat	upx
behavioral1/memory/2904-14-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2960-18-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2960-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2904 wrote to memory of 2960	2904	2024-01-08_45e34a968ff2926a976d52f2903c9736_cryptolocker.exe	28
PID 2904 wrote to memory of 2960	2904	2024-01-08_45e34a968ff2926a976d52f2903c9736_cryptolocker.exe	28
PID 2904 wrote to memory of 2960	2904	2024-01-08_45e34a968ff2926a976d52f2903c9736_cryptolocker.exe	28
PID 2904 wrote to memory of 2960	2904	2024-01-08_45e34a968ff2926a976d52f2903c9736_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-08_45e34a968ff2926a976d52f2903c9736_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_45e34a968ff2926a976d52f2903c9736_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2904
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
91KB

MD5
5579567c4e850e5b2d8345ffa714e5ef

SHA1
2f412d8ce3722726c935ecc1ced8fb2b9f3e55e9

SHA256
ff289054d96ecf47c845dad9531242e29b1b0d255ffa9627d09ded3e19c4611a

SHA512
6a9b4cbe9cd07143df682aa64a6a64e5092614cf58ca98b2093e356b6d55b6c4b90d9cf91b6c079b4d303c60f5a3188204b62f3ef51f5e80f53ca9cafc06e04b

Download Submit
memory/2904-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2904-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2904-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2904-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2904-14-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2904-16-0x0000000000670000-0x000000000067F000-memory.dmp

Filesize
60KB

Download
memory/2960-19-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2960-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2960-21-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2960-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download