Analysis

  • max time kernel
    149s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/03/2024, 00:00

General

  • Target

    2024-03-10_f2d72709ace821ceaf6cd54133c59a6d_cryptolocker.exe

  • Size

    92KB

  • MD5

    f2d72709ace821ceaf6cd54133c59a6d

  • SHA1

    2255d428ab6f67be8737f192d71c593bc428f108

  • SHA256

    8f9f63dbe017b563e7e0f37906c6f79bdec98212755ad9531ad15d90a2a5408d

  • SHA512

    3a29c5787e39ce6278a49ef311b3912899dc47c900ff6c1bffcde07f3264888860f70b890572ee0dbacf17e7e79802483be0314467f3bfe941b4c8d039230582

  • SSDEEP

    1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp0oL0:AnBdOOtEvwDpj6z/

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-10_f2d72709ace821ceaf6cd54133c59a6d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-10_f2d72709ace821ceaf6cd54133c59a6d_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2988

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          92KB

          MD5

          84b7e57003362c7350bff287cab4804b

          SHA1

          459c2cff12e044afb8d54105d7e0da6565ca447d

          SHA256

          7693ee0f38b33bacd5025f1364e6a9f54d5de27fe7893ca6ccffa7cc2ade318c

          SHA512

          2e69b90241cf30332cb8d3c0aa13ad521bada90d8befb94a4c2d5b31101fd93492f5586a3dd1e17d3eff35182ee7054f3744c3e8bfe9a2d50214f01927042e65

        • memory/2212-0-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2212-1-0x0000000000300000-0x0000000000306000-memory.dmp

          Filesize

          24KB

        • memory/2212-3-0x0000000000300000-0x0000000000306000-memory.dmp

          Filesize

          24KB

        • memory/2212-2-0x00000000004A0000-0x00000000004A6000-memory.dmp

          Filesize

          24KB

        • memory/2212-15-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2988-16-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB

        • memory/2988-18-0x00000000002F0000-0x00000000002F6000-memory.dmp

          Filesize

          24KB

        • memory/2988-21-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/2988-26-0x0000000000500000-0x000000000050F000-memory.dmp

          Filesize

          60KB