9f866108c0c7b7a229b7517c60d00c3a3803fa0006b12e4452846b9a0f86191c

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_46edb9b437602438828e4b1ee31f2df3_cryptolocker.exe
Size

125KB
MD5

46edb9b437602438828e4b1ee31f2df3
SHA1

5e9632fb29abffb94a274a921b6d03e5d23f3788
SHA256

9f866108c0c7b7a229b7517c60d00c3a3803fa0006b12e4452846b9a0f86191c
SHA512

8fb9238441dd2100de351db5a2bc2c83ea801a37e3e3514d748d6dd363ab60f38ba9af35a77658e05f4f03090471d7e26ba8837302274976db878a847f7f7985
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699GNtL1e04:AnBdOOtEvwDpj6zL

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2312	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3004	2024-01-10_46edb9b437602438828e4b1ee31f2df3_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3004-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000a000000012232-11.dat	upx
behavioral1/memory/3004-15-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2312-18-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2312-27-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 2312	3004	2024-01-10_46edb9b437602438828e4b1ee31f2df3_cryptolocker.exe	28
PID 3004 wrote to memory of 2312	3004	2024-01-10_46edb9b437602438828e4b1ee31f2df3_cryptolocker.exe	28
PID 3004 wrote to memory of 2312	3004	2024-01-10_46edb9b437602438828e4b1ee31f2df3_cryptolocker.exe	28
PID 3004 wrote to memory of 2312	3004	2024-01-10_46edb9b437602438828e4b1ee31f2df3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-10_46edb9b437602438828e4b1ee31f2df3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_46edb9b437602438828e4b1ee31f2df3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
126KB

MD5
4263154972fe2fda4930144e52be26a3

SHA1
84be63b23f00060a60b0cc2bc94ec844d815e891

SHA256
46e23739199586fb2f548c5c2137ad5848b9d20be8ad347c9106f903c96de1dd

SHA512
26481cc3d45ab5185efcc838ceaa8675f645a8e7edb4848e32a217922359029b202327f26040518dd052b198f0dd723b5c1f5830e02a6bc2c834a8714f51a8e5

Download Submit
memory/2312-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2312-21-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2312-19-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2312-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3004-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3004-1-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/3004-2-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/3004-4-0x0000000000230000-0x0000000000236000-memory.dmp

Filesize
24KB

Download
memory/3004-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3004-14-0x00000000004F0000-0x00000000004FF000-memory.dmp

Filesize
60KB

Download
memory/3004-28-0x00000000004F0000-0x00000000004FF000-memory.dmp

Filesize
60KB

Download