d4cf01ef5aaa15cc163c8573085d5c5aa96f5cda86445dea7d08929143d72176

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 02:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_13b07d77e161e67f2485ec356a4e267e_cryptolocker.exe
Size

45KB
MD5

13b07d77e161e67f2485ec356a4e267e
SHA1

78de77316b33edcc24a36678e4b9ff3169d8d38c
SHA256

d4cf01ef5aaa15cc163c8573085d5c5aa96f5cda86445dea7d08929143d72176
SHA512

abd605c88610548d77762319e3ba55e76d4259017bf7396179d644e7db3adb23c8b1dcdd35a860b50454ffed1b693d87378b7ff2fe645eacdf31615e39393fa4
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoL5p:qmbhXDmjr5MOtEvwDpj5cDtKkQZQd

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2284-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000a000000013a21-11.dat	CryptoLocker_rule2
behavioral1/memory/2284-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral1/memory/2284-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2284-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000a000000013a21-11.dat	UPX
behavioral1/memory/2284-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2996	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2284	2024-04-10_13b07d77e161e67f2485ec356a4e267e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2996	2284	2024-04-10_13b07d77e161e67f2485ec356a4e267e_cryptolocker.exe	28
PID 2284 wrote to memory of 2996	2284	2024-04-10_13b07d77e161e67f2485ec356a4e267e_cryptolocker.exe	28
PID 2284 wrote to memory of 2996	2284	2024-04-10_13b07d77e161e67f2485ec356a4e267e_cryptolocker.exe	28
PID 2284 wrote to memory of 2996	2284	2024-04-10_13b07d77e161e67f2485ec356a4e267e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-10_13b07d77e161e67f2485ec356a4e267e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_13b07d77e161e67f2485ec356a4e267e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
cf1f2bb0e2ff471d729942824dd0409e

SHA1
f870a965009765eb3e33cc1616ca3335f11d778b

SHA256
28f40fa4b83718f4c6be9a12689690e9e1ac3cc6d86c9303fbf0584b3ac786ab

SHA512
d4a03c6e7a4a70b3fb9b6760363ab0550571af8c5993c1ac95b6ba8f66426081c9dd30d36d329e517b0f800c63ec49ed1b157b40087a48f24f43175cb0dfd792

Download Submit
memory/2284-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2284-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2284-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2284-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2284-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2996-18-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download