d05ee407bbb959d3cbfd0b0a7d457029bb8634330b51cdbc7d48107ec9658a2f

Analysis

max time kernel
1s
max time network
2s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/02/2024, 04:26

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

2024-02-18_12de7a31b38174eea9e9485eb48385b1_cryptolocker.exe
Size

31KB
MD5

12de7a31b38174eea9e9485eb48385b1
SHA1

de88d1346c606ab3ed309ec46d4f5b42850dd53e
SHA256

d05ee407bbb959d3cbfd0b0a7d457029bb8634330b51cdbc7d48107ec9658a2f
SHA512

4bfddd9625579d98e733657df30756b2075bc23e9bf559313aa4174ed8722714158a8f09f97076e99c579a4a9c524f6fd0b67f73736a21700c8ad2ed9d06b462
SSDEEP

768:q0ZziOWwULueOSdE8tOOtEvwDpjeWaJIOc+4tHP:q0zizzOSxMOtEvwDpj/arqv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2228-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0008000000012262-11.dat	CryptoLocker_rule2
behavioral1/memory/2228-13-0x0000000002700000-0x0000000002710000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2720-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2228-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral1/memory/2720-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2228-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2228-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x0008000000012262-11.dat	UPX
behavioral1/memory/2228-13-0x0000000002700000-0x0000000002710000-memory.dmp	UPX
behavioral1/memory/2720-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2228-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2720	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2228	2024-02-18_12de7a31b38174eea9e9485eb48385b1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 2720	2228	2024-02-18_12de7a31b38174eea9e9485eb48385b1_cryptolocker.exe	28
PID 2228 wrote to memory of 2720	2228	2024-02-18_12de7a31b38174eea9e9485eb48385b1_cryptolocker.exe	28
PID 2228 wrote to memory of 2720	2228	2024-02-18_12de7a31b38174eea9e9485eb48385b1_cryptolocker.exe	28
PID 2228 wrote to memory of 2720	2228	2024-02-18_12de7a31b38174eea9e9485eb48385b1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-18_12de7a31b38174eea9e9485eb48385b1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_12de7a31b38174eea9e9485eb48385b1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
7d5c3102fb521baba3b3132059cecdf2

SHA1
66d8d867d6977cc51cc51a0cd655cfb0179f5583

SHA256
1469386e952a9e231d98f034c6eee38ea6142aa95df20708087bdff0f0b1d008

SHA512
74b4b6484c25f3e3dbddb1cf49aeb3b53d324586f198e05b36cc6495fd078918e165c6e820a247ad8d80b17594746950705b9c4a9d90178d7059976ff05e6c9c

Download Submit
memory/2228-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2228-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2228-3-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2228-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2228-13-0x0000000002700000-0x0000000002710000-memory.dmp

Filesize
64KB

Download
memory/2228-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2720-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download