f51b7235099db796dd90ed8aeb6421ee3c944635a4b9f131ec4e634057e952b2

Analysis

max time kernel
1s
max time network
144s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_21822071ffa10480aedec1251ac5179e_cryptolocker.exe
Size

32KB
MD5

21822071ffa10480aedec1251ac5179e
SHA1

c18d6658bd6337d2589a708f0b875441085e568c
SHA256

f51b7235099db796dd90ed8aeb6421ee3c944635a4b9f131ec4e634057e952b2
SHA512

ba198c8ae82bad0ca1277525871ccbaa5394268a5fb5a62efdbed7699ef19c2922c8daf2b8bb005500189c4f6d313522e38e1e3476c16e96388222d6ac08c36f
SSDEEP

768:qUmnjFom/kLyMro2GtOOtEvwDpjeMLam5apa:qUmnpomddpMOtEvwDpjjaYaw

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2684	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1856	2024-01-11_21822071ffa10480aedec1251ac5179e_cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1856-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/1856-15-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000a000000012243-24.dat	upx
behavioral1/memory/2684-16-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/files/0x000a000000012243-11.dat	upx
behavioral1/memory/2684-26-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 2684	1856	2024-01-11_21822071ffa10480aedec1251ac5179e_cryptolocker.exe	14
PID 1856 wrote to memory of 2684	1856	2024-01-11_21822071ffa10480aedec1251ac5179e_cryptolocker.exe	14
PID 1856 wrote to memory of 2684	1856	2024-01-11_21822071ffa10480aedec1251ac5179e_cryptolocker.exe	14
PID 1856 wrote to memory of 2684	1856	2024-01-11_21822071ffa10480aedec1251ac5179e_cryptolocker.exe	14

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
1⤵
- Executes dropped EXE
PID:2684

C:\Users\Admin\AppData\Local\Temp\2024-01-11_21822071ffa10480aedec1251ac5179e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_21822071ffa10480aedec1251ac5179e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
33KB

MD5
8ae0854832220d6602dd0509aa7da9e6

SHA1
a6adc506ea0e3cd77107cfa4cfbe32f5d640652e

SHA256
9979b3ad2c0d57e468f579fe4c2ae7b5b1e85c997fb7a85e4fbfad018a3c5e47

SHA512
712129de5268822473f76e0aeca579012b4a6fe9b20625b8c5a9d9161f92a85bcedc3736b67754ff560f0901d7860aae2929c01aa66804a6819f9293e77843dd

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
10KB

MD5
f55ef94d0daeee4580d6a3166184d053

SHA1
f38e22eb2712a231a4badea6b19bf23b2c6639b3

SHA256
d74f0435223059b4c884e57111169e32dec17543a736e05076a689c6fa9f9c28

SHA512
0a547e307228710c1b0db0b620037e75ced0f970c716fff344e4b0a1136cd901fadb549e4f7116acd48eca2e01dac523694ab97b16cba820f2e0609c60d826b1

Download Submit
memory/1856-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/1856-4-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1856-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1856-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1856-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2684-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2684-18-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2684-16-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2684-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download