46aa7d0ba35a4d5bb3dc02b5fe0c1a0371574225dc270b8d1b250a2acaa83df5

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 09:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-10_cd92bf0e0c7a2a8cfab75b7208e4a97b_cryptolocker.exe
Size

88KB
MD5

cd92bf0e0c7a2a8cfab75b7208e4a97b
SHA1

f3b688aed640a7bb8c4940a5db89595b3ee3c60a
SHA256

46aa7d0ba35a4d5bb3dc02b5fe0c1a0371574225dc270b8d1b250a2acaa83df5
SHA512

75fb8ea054e6e51dfbd16b3a005efad3d9bdd4413179dec0505b55396fdb3f394ade69e7238775d4b44dc3c359a17f6f03111bf21b43a8d3f03b00e7d1c453de
SSDEEP

1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQA+:n6a+1SEOtEvwDpjYYvQd2P+

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000014b27-11.dat	CryptoLocker_rule2
behavioral1/memory/1976-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2792-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2792-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c000000014b27-11.dat	CryptoLocker_set1
behavioral1/memory/1976-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2792-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2792-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000c000000014b27-11.dat	UPX
behavioral1/memory/1976-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2792-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2792-26-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2792	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1976	2024-05-10_cd92bf0e0c7a2a8cfab75b7208e4a97b_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1976-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000c000000014b27-11.dat	upx
behavioral1/memory/1976-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2792-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2792-26-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 2792	1976	2024-05-10_cd92bf0e0c7a2a8cfab75b7208e4a97b_cryptolocker.exe	28
PID 1976 wrote to memory of 2792	1976	2024-05-10_cd92bf0e0c7a2a8cfab75b7208e4a97b_cryptolocker.exe	28
PID 1976 wrote to memory of 2792	1976	2024-05-10_cd92bf0e0c7a2a8cfab75b7208e4a97b_cryptolocker.exe	28
PID 1976 wrote to memory of 2792	1976	2024-05-10_cd92bf0e0c7a2a8cfab75b7208e4a97b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-10_cd92bf0e0c7a2a8cfab75b7208e4a97b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-10_cd92bf0e0c7a2a8cfab75b7208e4a97b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
89KB

MD5
a60f59f69ba4759f7f04e013d3b0b921

SHA1
e1f3ffe24aefd9acc1140400d792ae4a69e5b0f5

SHA256
bc1e427cff9ea59428edff3146e40a187f6286bc569dbaba7f37d54ed3297f47

SHA512
9a32f3ba5569777d864b8d522663b11d972dc6a6d06ea32ce6bf5e5229642cd91932f39ca6e7b304bd2a1fa0473f2c0b54df744a4120ff91c8f20d0f1b26543d

Download Submit
memory/1976-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1976-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1976-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/1976-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1976-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2792-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2792-18-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2792-25-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2792-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download