a120b2b4757a6659cfd17d9eae9dced911ab1fc92a7f94a72e48adbe81ba0582

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
30/04/2024, 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_2ca11d635f336f4867e155023096a05b_cryptolocker.exe
Size

65KB
MD5

2ca11d635f336f4867e155023096a05b
SHA1

549c4ee6caf2c012894e14dc3f6f0d28b46eda5f
SHA256

a120b2b4757a6659cfd17d9eae9dced911ab1fc92a7f94a72e48adbe81ba0582
SHA512

ee934074ff2761816d308ddd6fae7d82ad43986376fa2048bf7fe6bc8d512743953e5ae51738b2960f3ce61e8e422f200f990ac66772c0ff82d0aa786ea795c6
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYZ8xDy6:1nK6a+qdOOtEvwDpj1

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/1180-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d00000001228a-11.dat	CryptoLocker_rule2
behavioral1/memory/1180-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1836-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/1180-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000d00000001228a-11.dat	CryptoLocker_set1
behavioral1/memory/1180-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/1836-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/1180-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/files/0x000d00000001228a-11.dat	UPX
behavioral1/memory/1180-16-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/1836-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1836	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1180	2024-04-30_2ca11d635f336f4867e155023096a05b_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1180-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x000d00000001228a-11.dat	upx
behavioral1/memory/1180-16-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/1836-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 1836	1180	2024-04-30_2ca11d635f336f4867e155023096a05b_cryptolocker.exe	28
PID 1180 wrote to memory of 1836	1180	2024-04-30_2ca11d635f336f4867e155023096a05b_cryptolocker.exe	28
PID 1180 wrote to memory of 1836	1180	2024-04-30_2ca11d635f336f4867e155023096a05b_cryptolocker.exe	28
PID 1180 wrote to memory of 1836	1180	2024-04-30_2ca11d635f336f4867e155023096a05b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-30_2ca11d635f336f4867e155023096a05b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_2ca11d635f336f4867e155023096a05b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
65KB

MD5
508591193aa2246902dafc1c4a2f0e5d

SHA1
675204b510a5b49d17abc99b11dc38e96e3fcc76

SHA256
5aed5cc1744db6a97c79f37e8d5b75dbaaa190d8e13e67ef078c017a2d8b5c09

SHA512
674c69388448c7be4c75e28150ffeea26363283e7c4c1f6eb19c6af9fa9d8d2b9b4258bda741869f546e12bb69f3c1d33b1d6bc49533564cb6cd77308af86ba2

Download Submit
memory/1180-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1180-3-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1180-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1180-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1180-16-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1180-15-0x00000000023A0000-0x00000000023B0000-memory.dmp

Filesize
64KB

Download
memory/1836-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1836-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1836-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download