71acdcd765ec5628c86227b01459e508755ee83905f8fe655ed3f604d03b9c91

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
24/01/2024, 12:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-24_e848f7c2406db68d8ed2754e5908a609_cryptolocker.exe
Size

56KB
MD5

e848f7c2406db68d8ed2754e5908a609
SHA1

e46b33bcb2bf1a36f2ca39a041990557d2be5fa7
SHA256

71acdcd765ec5628c86227b01459e508755ee83905f8fe655ed3f604d03b9c91
SHA512

8a74307606d35f7fcbb2d4639e2e679b0e248791891e9c8dfd33b8026075e88cb30e7a0b0986246a0f1cbc3bc8beefbd10ce59dcaed511fcd0f8200f616c58f2
SSDEEP

768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5apr:z6QFElP6n+gKmddpMOtEvwDpj9aYal

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d000000012251-11.dat	CryptoLocker_rule2
behavioral1/memory/2232-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2708-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2708-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d000000012251-11.dat	CryptoLocker_set1
behavioral1/memory/2232-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2708-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2708-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000d000000012251-11.dat	UPX
behavioral1/memory/2232-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2708-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2708-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2708	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2232	2024-01-24_e848f7c2406db68d8ed2754e5908a609_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000d000000012251-11.dat	upx
behavioral1/memory/2232-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2708-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2708-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2708	2232	2024-01-24_e848f7c2406db68d8ed2754e5908a609_cryptolocker.exe	28
PID 2232 wrote to memory of 2708	2232	2024-01-24_e848f7c2406db68d8ed2754e5908a609_cryptolocker.exe	28
PID 2232 wrote to memory of 2708	2232	2024-01-24_e848f7c2406db68d8ed2754e5908a609_cryptolocker.exe	28
PID 2232 wrote to memory of 2708	2232	2024-01-24_e848f7c2406db68d8ed2754e5908a609_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-24_e848f7c2406db68d8ed2754e5908a609_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-24_e848f7c2406db68d8ed2754e5908a609_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
56KB

MD5
a20d68269ff150f242ca16e4ccc39792

SHA1
d589cced133e1179089e82a3abe370eda791cce6

SHA256
cd5b4542b12eff591c122d0e39f307f2a33bbcda1754858b4fd9992643ea27a4

SHA512
af95fb0d83a1159aabc3381074761c8b5164e612b9ca85c28a221edac3e1534c45253b921034b3349986cf0f6f084fc16ae2555015633ec20df0faaa0c094fb8

Download Submit
memory/2232-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2232-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2232-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2232-9-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2232-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2708-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2708-18-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2708-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2708-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download