354c7883c36c383933863ea7d7e5cc1042e4674ea40d9b9f38b993623d044fcc

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_b1b9fa34deca2f0918c07e8988df8675_cryptolocker.exe
Size

79KB
MD5

b1b9fa34deca2f0918c07e8988df8675
SHA1

1b230dc2ae8f531e95f76797f72a2680cb5d80f6
SHA256

354c7883c36c383933863ea7d7e5cc1042e4674ea40d9b9f38b993623d044fcc
SHA512

b66bb28ed3d3d493e6911f86002ec3559775f755b498aeaeed0cb6ffd55890df0086f089fe059756aacbc0602900af12aba8f989fb1cbdbae92e7ddb787e9d87
SSDEEP

1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOA+YSafiPuqd8:T6a+rdOOtEvwDpjNcF

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1656-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x0009000000014909-11.dat	CryptoLocker_rule2
behavioral1/memory/2548-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1656-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2548-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1656-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x0009000000014909-11.dat	CryptoLocker_set1
behavioral1/memory/2548-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1656-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2548-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/1656-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x0009000000014909-11.dat	UPX
behavioral1/memory/2548-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/1656-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2548-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2548	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1656	2024-04-27_b1b9fa34deca2f0918c07e8988df8675_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1656-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0009000000014909-11.dat	upx
behavioral1/memory/2548-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1656-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2548-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 2548	1656	2024-04-27_b1b9fa34deca2f0918c07e8988df8675_cryptolocker.exe	28
PID 1656 wrote to memory of 2548	1656	2024-04-27_b1b9fa34deca2f0918c07e8988df8675_cryptolocker.exe	28
PID 1656 wrote to memory of 2548	1656	2024-04-27_b1b9fa34deca2f0918c07e8988df8675_cryptolocker.exe	28
PID 1656 wrote to memory of 2548	1656	2024-04-27_b1b9fa34deca2f0918c07e8988df8675_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-27_b1b9fa34deca2f0918c07e8988df8675_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_b1b9fa34deca2f0918c07e8988df8675_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
79KB

MD5
4ea20028393120ad0e2632b0d7400ac7

SHA1
8c45cd2eaa74590c91a8cf76a08f90cbcf66e210

SHA256
59226448fee9c9f3b5be8608c1bf0daf25eea68f86a1686ce0aa7f2fbb20aefa

SHA512
737e07ad2f0f31cb9c4f777ca5a04997c7d9c5f2403c6d19d6c632f734c237618bddea512d52a335162971fbe28c20cf99c341b338a1a5a2f1bc77ed3b756783

Download Submit
memory/1656-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1656-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1656-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1656-2-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/1656-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2548-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2548-18-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2548-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download