f6104f1e9db601a9ba884901c2bf518969337e44074212ab907c75fadc68a12c

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
27/01/2024, 19:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_7db6369e78e2e7d2564171e37fc7b9d8_cryptolocker.exe
Size

64KB
MD5

7db6369e78e2e7d2564171e37fc7b9d8
SHA1

759d037d2d47671d4b1be3b45b68cb72bd2e5996
SHA256

f6104f1e9db601a9ba884901c2bf518969337e44074212ab907c75fadc68a12c
SHA512

f40b361dd311a598a9aa4709746eb6e4b2655e4b9ba48a949557c3afd875c710dc3a7db3899d5c918724b28d4512c5f8beee65c8a000fa7358d1f2cf74fc44d5
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUa1Fu:T6a+rdOOtEvwDpjNO

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b000000012267-11.dat	CryptoLocker_rule2
behavioral1/memory/1984-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2344-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2344-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b000000012267-11.dat	CryptoLocker_set1
behavioral1/memory/1984-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2344-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2344-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000b000000012267-11.dat	UPX
behavioral1/memory/1984-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2344-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2344-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2344	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1984	2024-01-27_7db6369e78e2e7d2564171e37fc7b9d8_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1984-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000b000000012267-11.dat	upx
behavioral1/memory/1984-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2344-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2344-27-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2344	1984	2024-01-27_7db6369e78e2e7d2564171e37fc7b9d8_cryptolocker.exe	28
PID 1984 wrote to memory of 2344	1984	2024-01-27_7db6369e78e2e7d2564171e37fc7b9d8_cryptolocker.exe	28
PID 1984 wrote to memory of 2344	1984	2024-01-27_7db6369e78e2e7d2564171e37fc7b9d8_cryptolocker.exe	28
PID 1984 wrote to memory of 2344	1984	2024-01-27_7db6369e78e2e7d2564171e37fc7b9d8_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-27_7db6369e78e2e7d2564171e37fc7b9d8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_7db6369e78e2e7d2564171e37fc7b9d8_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
a48e056f56670e3a04d7496ad73bb999

SHA1
649cc60696a3e4dc658c80a7833f1135411eb9fd

SHA256
916692bf185afd30c1d27dd118c8fef8256a377094424fab44e7bdd4a0825a7e

SHA512
5cd3f87b1c56ea015bb62864e599b3da14861e259710c9b41a45172add2aeed89e90b8554e6bf9db687ae8ce09311eceb5f88ac18020ffa06facd4bace70cd99

Download Submit
memory/1984-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1984-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1984-3-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/1984-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1984-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1984-14-0x0000000001DE0000-0x0000000001DF0000-memory.dmp

Filesize
64KB

Download
memory/2344-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2344-20-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2344-19-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2344-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download