eca06b0379573fc855f022a8ed02f8ed22727a2ec19c07f78710d8625669d85b

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
16-04-2024 08:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_8d1278e8dc70d1f5d1f345b658ce179c_cryptolocker.exe
Size

37KB
MD5

8d1278e8dc70d1f5d1f345b658ce179c
SHA1

41986d2062d46bab43d3db18c4da29e9f50cec44
SHA256

eca06b0379573fc855f022a8ed02f8ed22727a2ec19c07f78710d8625669d85b
SHA512

355ed65f370ff92410df9dd34ce73e1534f1cf426f16684fcf79168892e8b4132c8077881db1ed191a1f970971157a479e4aa0e520ae2724b219d70bb86dbaec
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYl:qDdFJy3QMOtEvwDpjjWMl7Tg

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/856-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d000000012248-11.dat	CryptoLocker_rule2
behavioral1/memory/856-13-0x0000000002AC0000-0x0000000002AD0000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/856-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/280-22-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/856-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d000000012248-11.dat	CryptoLocker_set1
behavioral1/memory/856-13-0x0000000002AC0000-0x0000000002AD0000-memory.dmp	CryptoLocker_set1
behavioral1/memory/856-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/280-22-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/856-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000d000000012248-11.dat	UPX
behavioral1/memory/856-13-0x0000000002AC0000-0x0000000002AD0000-memory.dmp	UPX
behavioral1/memory/856-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/280-22-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
280	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
856	2024-04-16_8d1278e8dc70d1f5d1f345b658ce179c_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/856-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000d000000012248-11.dat	upx
behavioral1/memory/856-13-0x0000000002AC0000-0x0000000002AD0000-memory.dmp	upx
behavioral1/memory/856-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/280-22-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 280	856	2024-04-16_8d1278e8dc70d1f5d1f345b658ce179c_cryptolocker.exe	28
PID 856 wrote to memory of 280	856	2024-04-16_8d1278e8dc70d1f5d1f345b658ce179c_cryptolocker.exe	28
PID 856 wrote to memory of 280	856	2024-04-16_8d1278e8dc70d1f5d1f345b658ce179c_cryptolocker.exe	28
PID 856 wrote to memory of 280	856	2024-04-16_8d1278e8dc70d1f5d1f345b658ce179c_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-16_8d1278e8dc70d1f5d1f345b658ce179c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_8d1278e8dc70d1f5d1f345b658ce179c_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
af09590af953898b81b3059dba92b914

SHA1
a73f2354c31c099544e58495aaaab9c804ec5799

SHA256
2d5b52b2a20d8f636b8baa51b061db1d862f68b3b164026b52454a26c0ed130b

SHA512
85b95d9497af36cc218cf849f949b77abca90af2d286fcaf4441bbd88f43b019680646fbd68c37b35c6924623b503b3371d619a95da7da5ab37e9f4e8a2cff12

Download Submit
memory/280-18-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/280-20-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/280-22-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/856-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/856-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/856-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/856-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/856-13-0x0000000002AC0000-0x0000000002AD0000-memory.dmp

Filesize
64KB

Download
memory/856-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download