115a05ca0e2a92548f84ceb73cb4b8f6b2e56a580badef355a46cd82ef78a015

Analysis

max time kernel
1s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 05:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_f017d04002d0109f574bd031dded5c97_cryptolocker.exe
Size

116KB
MD5

f017d04002d0109f574bd031dded5c97
SHA1

a1235462b192030fe8202eeb8e4999b6107fd831
SHA256

115a05ca0e2a92548f84ceb73cb4b8f6b2e56a580badef355a46cd82ef78a015
SHA512

186d00d40056bfd6c3a55bbe27609b699cc1cb69cc6c828cbdd2bde461b0fa19493051ca1013803eb9c527d41cb0407249f647307c8e64da0521e341e504d0eb
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjCGYQbN/PKwNgerar/Q:T6a+rdOOtEvwDpjLzx

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2304	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2064	2024-01-10_f017d04002d0109f574bd031dded5c97_cryptolocker.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2064-13-0x00000000026C0000-0x00000000026D0000-memory.dmp	upx
behavioral1/files/0x000a00000001226e-25.dat	upx
behavioral1/memory/2304-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2064-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000a00000001226e-15.dat	upx
behavioral1/files/0x000a00000001226e-11.dat	upx
behavioral1/memory/2304-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2304	2064	2024-01-10_f017d04002d0109f574bd031dded5c97_cryptolocker.exe	18
PID 2064 wrote to memory of 2304	2064	2024-01-10_f017d04002d0109f574bd031dded5c97_cryptolocker.exe	18
PID 2064 wrote to memory of 2304	2064	2024-01-10_f017d04002d0109f574bd031dded5c97_cryptolocker.exe	18
PID 2064 wrote to memory of 2304	2064	2024-01-10_f017d04002d0109f574bd031dded5c97_cryptolocker.exe	18

C:\Users\Admin\AppData\Local\Temp\2024-01-10_f017d04002d0109f574bd031dded5c97_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_f017d04002d0109f574bd031dded5c97_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
6KB

MD5
60a1f0c2f9cb38dc5191e2ef9de375c2

SHA1
6f831533d54ceccd8910d2738c5758bb45f99799

SHA256
5e313e68a0dba713798bfbca26412c2f195f654cf94d73858adecbf502cddfa2

SHA512
b983466d836327995937b72b67cf86b43c6471975a38ef8d85d137f4e404003a4c3a06b3b5496b1bbc8dc06b781bb80a107e3526cc041b43bd28532cd7d59f36

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
17KB

MD5
9e3b8a9634b7fb8dd05af2bc7dd39340

SHA1
d9178b9666504f99f1c103567e146d1b556a46a4

SHA256
d81216da7ecde5b236d70c10f09c0f9cb1db413d2b5e4c8879c56531dd1c5e06

SHA512
cb80926876d9f57722f63d44ee93dafa896f5d467d90a1b4b21aca3c0d58d99f5e0e3ef08e97d071de8e85d7895e8aa49f40531b5b3cbd740a2399fedf4104ce

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
12KB

MD5
fc14bcef5919afc89ef6f251b11e2e3d

SHA1
078d1f0084c74c28ed05f2e6879a4a6f685d5045

SHA256
84ee573df5afddac3d943dbb35afc65636e0e5efee7ceebed74475d626ed75ea

SHA512
8a5626856f95e4fed0c5abc853eb9d7a59ea51fbb2473539f3d2dc3a95521621b7263969a993dca595e0ee649c8eb4e1f089f60084f3a150a6ea078f390e0368

Download Submit
memory/2064-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2064-13-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/2064-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2064-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2064-2-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2064-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2304-26-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2304-19-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2304-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2304-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download