9bf399c0e13d50396d6dd763b8ea99420fa3a10f73a308f4162455405da65621

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27/04/2024, 02:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_1d76cd92b70f793c614ba5270b41c054_cryptolocker.exe
Size

38KB
MD5

1d76cd92b70f793c614ba5270b41c054
SHA1

8fd7468a09d95ff095fe49800ac1affdc7da8029
SHA256

9bf399c0e13d50396d6dd763b8ea99420fa3a10f73a308f4162455405da65621
SHA512

4aad0c18e9b15d239d89870dd79f138f84e770376f37bfb881b9c1233411ed8a00dbad03da83e2d89a920ef7788f0bfd89e764d69fcbe407ba9d8125995f87ce
SSDEEP

768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITY7:qDdFJy3QMOtEvwDpjjWMl7Ta

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2524-8-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2524-13-0x00000000022A0000-0x00000000022B0000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c00000001269e-16.dat	CryptoLocker_rule2
behavioral1/memory/1816-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2524-8-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2524-13-0x00000000022A0000-0x00000000022B0000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c00000001269e-16.dat	CryptoLocker_set1
behavioral1/memory/1816-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2524-8-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2524-13-0x00000000022A0000-0x00000000022B0000-memory.dmp	UPX
behavioral1/files/0x000c00000001269e-16.dat	UPX
behavioral1/memory/1816-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1816	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2524	2024-04-27_1d76cd92b70f793c614ba5270b41c054_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2524-8-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2524-13-0x00000000022A0000-0x00000000022B0000-memory.dmp	upx
behavioral1/files/0x000c00000001269e-16.dat	upx
behavioral1/memory/1816-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 1816	2524	2024-04-27_1d76cd92b70f793c614ba5270b41c054_cryptolocker.exe	28
PID 2524 wrote to memory of 1816	2524	2024-04-27_1d76cd92b70f793c614ba5270b41c054_cryptolocker.exe	28
PID 2524 wrote to memory of 1816	2524	2024-04-27_1d76cd92b70f793c614ba5270b41c054_cryptolocker.exe	28
PID 2524 wrote to memory of 1816	2524	2024-04-27_1d76cd92b70f793c614ba5270b41c054_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-27_1d76cd92b70f793c614ba5270b41c054_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_1d76cd92b70f793c614ba5270b41c054_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
c86aa98c149418f74d3e803a0dc6b00f

SHA1
7e022cbb871e6d621820d2bf53edf5fe198acacd

SHA256
0908b149048b8642ce0b2edb8ad6f422864f31ad3cced1ec0b96be019ffb42af

SHA512
d1cf5dcdd133a38ed74fb436aa1c6beb2a78a52b27d5c1e59d6f04dc7a98d51c2461ac5f9793543d3c5bedeac0b9150593b757a7ced80341395289a2668efb6a

Download Submit
memory/1816-18-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1816-25-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1816-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2524-1-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2524-9-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2524-8-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2524-0-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2524-13-0x00000000022A0000-0x00000000022B0000-memory.dmp

Filesize
64KB

Download