07d626dba4c80659aa3af44cb19437bce4e1c34594e7c8929c73abd6ac5ecd9f

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_65813548b99f1040383212ab4d02f965_cryptolocker.exe
Size

44KB
MD5

65813548b99f1040383212ab4d02f965
SHA1

e52379e5141132b1653efcf82354fa65ec9699b7
SHA256

07d626dba4c80659aa3af44cb19437bce4e1c34594e7c8929c73abd6ac5ecd9f
SHA512

0f8c07105c733f43702bfb6c58fa69eea44a5eb029967b34049d140c2bdcdf9bdfd691565d538398e60f32e9263f0adffc6fc2203763a157c6e1f68163f565d5
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoK:qmbhXDmjr5MOtEvwDpj5cDtKkQZQg

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/2288-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a00000001224a-11.dat	CryptoLocker_rule2
behavioral1/memory/2288-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2288-13-0x00000000004F0000-0x0000000000500000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2032-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2032-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2288-1-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2288-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2032-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2032-27-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/2288-1-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000a00000001224a-11.dat	UPX
behavioral1/memory/2288-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2288-13-0x00000000004F0000-0x0000000000500000-memory.dmp	UPX
behavioral1/memory/2032-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2032-27-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2032	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2288	2024-01-29_65813548b99f1040383212ab4d02f965_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2032	2288	2024-01-29_65813548b99f1040383212ab4d02f965_cryptolocker.exe	28
PID 2288 wrote to memory of 2032	2288	2024-01-29_65813548b99f1040383212ab4d02f965_cryptolocker.exe	28
PID 2288 wrote to memory of 2032	2288	2024-01-29_65813548b99f1040383212ab4d02f965_cryptolocker.exe	28
PID 2288 wrote to memory of 2032	2288	2024-01-29_65813548b99f1040383212ab4d02f965_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-29_65813548b99f1040383212ab4d02f965_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_65813548b99f1040383212ab4d02f965_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
0aa19b9809d0dd911a470c24e0ab6919

SHA1
1effa077dbbe147819ec890499226e7feedceb3a

SHA256
535353cb1c9c405068c71dda026840dfd8b6501680d3b836d399c1ee5575b7d5

SHA512
6de311e32175eb22ccc6a3b7967f865d91bde2f3e010b8576977c24a7ee862fcd64e1d19e039783e19bbf5883219e828b3d2f1146e7b21ab849ca81e00ba0777

Download Submit
memory/2032-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2032-19-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2032-23-0x00000000003A0000-0x00000000003A6000-memory.dmp

Filesize
24KB

Download
memory/2032-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2288-1-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2288-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2288-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2288-4-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2288-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2288-13-0x00000000004F0000-0x0000000000500000-memory.dmp

Filesize
64KB

Download
memory/2288-28-0x00000000004F0000-0x0000000000500000-memory.dmp

Filesize
64KB

Download