Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:22
Behavioral task
behavioral1
Sample
2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe
-
Size
38KB
-
MD5
054b14f60175852c0ebb5c3eef9f00bf
-
SHA1
b4f9eb84b53a78d1f24d2f727fe121e2fa2db31e
-
SHA256
a69efb6de03a030bbd0f9411224f1121283e8f5ef4612825571313c468e75676
-
SHA512
a1b20f3b0df57bfe6207c0e003577647af1ed40f7137547e0619efbbfdc17a960d1ca7433899f5cca89c39b7a27d525a34ea2cb1972d4479633948ae00789e8c
-
SSDEEP
768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY9T:qDdFJy3QMOtEvwDpjjWMl7TE
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2292-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 behavioral1/memory/2292-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2736-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2736-27-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2292-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_set1 behavioral1/memory/2292-17-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/2736-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/2736-27-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2292-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX \Users\Admin\AppData\Local\Temp\asih.exe UPX behavioral1/memory/2292-17-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/2736-16-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/2736-27-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 2736 asih.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exepid process 2292 2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe -
Processes:
resource yara_rule behavioral1/memory/2292-0-0x0000000000500000-0x0000000000510000-memory.dmp upx \Users\Admin\AppData\Local\Temp\asih.exe upx behavioral1/memory/2292-17-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2736-16-0x0000000000500000-0x0000000000510000-memory.dmp upx behavioral1/memory/2736-27-0x0000000000500000-0x0000000000510000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exedescription pid process target process PID 2292 wrote to memory of 2736 2292 2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe asih.exe PID 2292 wrote to memory of 2736 2292 2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe asih.exe PID 2292 wrote to memory of 2736 2292 2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe asih.exe PID 2292 wrote to memory of 2736 2292 2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_054b14f60175852c0ebb5c3eef9f00bf_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\asih.exeFilesize
38KB
MD589ca24ebd5409c55bdd931f779d8e90f
SHA1a1927f1cfa0bae96f8369ce69914724d2519ee5b
SHA25619310d69048d8fe64a1cee94f84d79447b92e93222474cfcbad508be06e3ad89
SHA51255b03d1c58c56044758ec0ca40781f5a2ba35547101a09a4158ccff28329a7a45a26a0685ae644556122dc50e6de14a71b35cb5c5aa784c1494680ff323d40d5
-
memory/2292-0-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/2292-1-0x00000000002D0000-0x00000000002D6000-memory.dmpFilesize
24KB
-
memory/2292-2-0x00000000002D0000-0x00000000002D6000-memory.dmpFilesize
24KB
-
memory/2292-3-0x00000000004B0000-0x00000000004B6000-memory.dmpFilesize
24KB
-
memory/2292-17-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/2736-16-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/2736-19-0x0000000000460000-0x0000000000466000-memory.dmpFilesize
24KB
-
memory/2736-26-0x0000000000320000-0x0000000000326000-memory.dmpFilesize
24KB
-
memory/2736-27-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB