Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    24/04/2024, 04:44

General

  • Target

    2024-04-24_d3ff08fd192e342ee350bfd8d8da5270_cryptolocker.exe

  • Size

    38KB

  • MD5

    d3ff08fd192e342ee350bfd8d8da5270

  • SHA1

    3a1dd5019eb77d4bbd94d7657bdaead74ae4e56b

  • SHA256

    a8af1ab2c8b1f438ccbfff89f08860f4f705da36cc247fb9eb1b5bccf4c1c2fc

  • SHA512

    b2b5b8c5f5e6d8086e0b28ffe54439dfb0cfac89dead72c82a83a3e42da020c0483bb64c26a596120972a0ee1eeab95fa19605484987039a1ab99f29be30cff4

  • SSDEEP

    768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY91:qDdFJy3QMOtEvwDpjjWMl7T+

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-24_d3ff08fd192e342ee350bfd8d8da5270_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-24_d3ff08fd192e342ee350bfd8d8da5270_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1740
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2716

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    38KB

    MD5

    d43d526dc5e173e5d68cf47899a2bcf4

    SHA1

    6b75c9482214c90a708b3ccb43c52c48156ff18d

    SHA256

    04aa43222e0cf0cff720810ea103f16e5e9a800021da506729ff347a8c418fac

    SHA512

    66ae15859bbd248a2ad85c0a4aed8b6ab619f3ce14e9e59369f138845bc0d0a62d200ba3778d40bed38e288a07528abe165a951b912cba751c0369c98b658b45

  • memory/1740-0-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/1740-2-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1740-1-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/1740-4-0x0000000000320000-0x0000000000326000-memory.dmp

    Filesize

    24KB

  • memory/2716-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2716-18-0x0000000000360000-0x0000000000366000-memory.dmp

    Filesize

    24KB

  • memory/2716-25-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB