666523ec55e73d43e95460ebdc98c648bc780a88cd7ea5a507d64e34d5b8b3ec

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 05:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-03_05f208a1f5c5794d45dd9963d3d050a7_cryptolocker.exe
Size

48KB
MD5

05f208a1f5c5794d45dd9963d3d050a7
SHA1

9bc0a077a77eaac9b4f74b92f35fd1d617b4ad27
SHA256

666523ec55e73d43e95460ebdc98c648bc780a88cd7ea5a507d64e34d5b8b3ec
SHA512

0a0201ec792f3dacbea99435108c5e21ef9db97be93ebd7b6f87fdf5b19c456542ae02538f4e34190c3d6d57d0fe9b9b07cc49541865dfe1b1652d80f8719496
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQPdUvw:BbdDmjr+OtEvwDpjMXZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 6 IoCs

resource	yara_rule
behavioral1/memory/3048-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001224d-11.dat	CryptoLocker_rule2
behavioral1/memory/2752-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3048-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/3048-13-0x0000000000550000-0x0000000000560000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2752-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral1/memory/2752-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/3048-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2752-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 6 IoCs

resource	yara_rule
behavioral1/memory/3048-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000b00000001224d-11.dat	UPX
behavioral1/memory/2752-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/3048-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/3048-13-0x0000000000550000-0x0000000000560000-memory.dmp	UPX
behavioral1/memory/2752-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2752	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3048	2024-02-03_05f208a1f5c5794d45dd9963d3d050a7_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 2752	3048	2024-02-03_05f208a1f5c5794d45dd9963d3d050a7_cryptolocker.exe	28
PID 3048 wrote to memory of 2752	3048	2024-02-03_05f208a1f5c5794d45dd9963d3d050a7_cryptolocker.exe	28
PID 3048 wrote to memory of 2752	3048	2024-02-03_05f208a1f5c5794d45dd9963d3d050a7_cryptolocker.exe	28
PID 3048 wrote to memory of 2752	3048	2024-02-03_05f208a1f5c5794d45dd9963d3d050a7_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-03_05f208a1f5c5794d45dd9963d3d050a7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_05f208a1f5c5794d45dd9963d3d050a7_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
31ea68f2058025db0fdc9b695d3829b9

SHA1
d1d370f3f01e126acd6ab1773fcc6dab974e8f17

SHA256
e69454553495f26766b64a98baf35b48e127087c44f367f6b86783c2fadbd492

SHA512
752ba73fdc5f14c83876461f331932ae7ccdece52369f1f3a7287e16b0e23bc00c7a32385813dffcd2a5b704522a66b5c2c605a9656e748b5d19350d45282681

Download Submit
memory/2752-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2752-19-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2752-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3048-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3048-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3048-2-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/3048-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3048-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3048-13-0x0000000000550000-0x0000000000560000-memory.dmp

Filesize
64KB

Download