Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    13/02/2024, 08:44

General

  • Target

    2024-02-13_ab38d18d7a657f2aaf117dbc653c85fe_cryptolocker.exe

  • Size

    86KB

  • MD5

    ab38d18d7a657f2aaf117dbc653c85fe

  • SHA1

    12400fccda20ef413e138ba3c79e391e23a1b725

  • SHA256

    d17b0669556b51a7f7716ef92dbdf07c8e0c8e9f9abd128224ecc4880d149fb8

  • SHA512

    bc80edb53e3548f8b95cb9e8dc9ffdf0252810ce9031d8275cc41024fb26feaf5c164941c51b9081f4cff02477fd1df8c02060b94967404f29e64c596f8ce6da

  • SSDEEP

    1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwMgL6:AnBdOOtEvwDpj6zi

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-13_ab38d18d7a657f2aaf117dbc653c85fe_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-13_ab38d18d7a657f2aaf117dbc653c85fe_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2232
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2708

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          87KB

          MD5

          ef05e03335951c40387eb98a7d369405

          SHA1

          800168ed30ddb980a34201533adc3455265e78de

          SHA256

          9ca0917c7d42abf1fd889f3b0392b7555289365bef6bab457f1b338a58261920

          SHA512

          57e3103ecda17b629a214e8b139c92ee23bc286ee2726124a4509ba3f07913c856737a08251643a1130915d1da9a1b5d35b54039564eb6386c47b153ed575947

        • memory/2232-0-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2232-1-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2232-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/2232-9-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2232-15-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2708-16-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2708-18-0x0000000000460000-0x0000000000466000-memory.dmp

          Filesize

          24KB

        • memory/2708-20-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/2708-26-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB