364a0b137b00c135c367bf35b60ea5a141c96a88b0a3c71da8b09397cadcb57f

Analysis

max time kernel
135s
max time network
142s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_89f6add9966eb03c8aa443ecf2add68e_cryptolocker.exe
Size

115KB
MD5

89f6add9966eb03c8aa443ecf2add68e
SHA1

870a3971810501293da2f4def75bfaf319169804
SHA256

364a0b137b00c135c367bf35b60ea5a141c96a88b0a3c71da8b09397cadcb57f
SHA512

506c71b459c4b945afe7e26008620e6fd81a226bab79a599144be5b10170763828a1529d6dbe620817328f91865fed5ef3f2a9bd495a2c9ebbe7839323f7d728
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjCGYQbN/PKwNgerar/x:T6a+rdOOtEvwDpjLzA

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1604	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2100	2024-01-10_89f6add9966eb03c8aa443ecf2add68e_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2100-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000800000000b529-11.dat	upx
behavioral1/memory/2100-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1604-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2100-13-0x00000000021E0000-0x00000000021F0000-memory.dmp	upx
behavioral1/memory/1604-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 1604	2100	2024-01-10_89f6add9966eb03c8aa443ecf2add68e_cryptolocker.exe	28
PID 2100 wrote to memory of 1604	2100	2024-01-10_89f6add9966eb03c8aa443ecf2add68e_cryptolocker.exe	28
PID 2100 wrote to memory of 1604	2100	2024-01-10_89f6add9966eb03c8aa443ecf2add68e_cryptolocker.exe	28
PID 2100 wrote to memory of 1604	2100	2024-01-10_89f6add9966eb03c8aa443ecf2add68e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-10_89f6add9966eb03c8aa443ecf2add68e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_89f6add9966eb03c8aa443ecf2add68e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
115KB

MD5
1904e64abc08c882e9b509c7ae400181

SHA1
37aeada87e9392b03ee720e465ba8663423388a2

SHA256
59eb17245b46bdc39e8b34f702babf1a0d46623951998c4753c0407fab03cfea

SHA512
2416219914bcb12e63a76613f6abf8e3078e6c810d043702724bcb812fecd98c306bcaf853489fdd7e3677ee5eff234539272e4d61650ece298951986271a24b

Download Submit
memory/1604-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1604-19-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/1604-21-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1604-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2100-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2100-1-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2100-2-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2100-9-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2100-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2100-13-0x00000000021E0000-0x00000000021F0000-memory.dmp

Filesize
64KB

Download