e74f2e1169ff970739ab96b2e22b5a5fb1422a94cee07cdea19ce96486a26ad8

Analysis

max time kernel
147s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-11_0ee3258f1a686bbe6aebafaccaa72fbd_cryptolocker.exe
Size

65KB
MD5

0ee3258f1a686bbe6aebafaccaa72fbd
SHA1

5b77bdbc47b539cf70f84295b0ab83152adc6c77
SHA256

e74f2e1169ff970739ab96b2e22b5a5fb1422a94cee07cdea19ce96486a26ad8
SHA512

0fb1dc90b252cfca2fd67990f6bbb0adfafd0968bc38567552e74568a22080e2e1b59a07820eb1c2c17516c6eb49d2cbe0c103435fc555c047329d1232666bdf
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjY6UAXXC:1nK6a+qdOOtEvwDpjS

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001267a-11.dat	CryptoLocker_rule2
behavioral1/memory/2852-13-0x0000000002BC0000-0x0000000002BD0000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2852-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2380-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000b00000001267a-11.dat	CryptoLocker_set1
behavioral1/memory/2852-13-0x0000000002BC0000-0x0000000002BD0000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2852-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/2380-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/files/0x000b00000001267a-11.dat	UPX
behavioral1/memory/2852-13-0x0000000002BC0000-0x0000000002BD0000-memory.dmp	UPX
behavioral1/memory/2852-16-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/2380-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2380	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2852	2024-05-11_0ee3258f1a686bbe6aebafaccaa72fbd_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2852-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x000b00000001267a-11.dat	upx
behavioral1/memory/2852-13-0x0000000002BC0000-0x0000000002BD0000-memory.dmp	upx
behavioral1/memory/2852-16-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2380-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2380	2852	2024-05-11_0ee3258f1a686bbe6aebafaccaa72fbd_cryptolocker.exe	28
PID 2852 wrote to memory of 2380	2852	2024-05-11_0ee3258f1a686bbe6aebafaccaa72fbd_cryptolocker.exe	28
PID 2852 wrote to memory of 2380	2852	2024-05-11_0ee3258f1a686bbe6aebafaccaa72fbd_cryptolocker.exe	28
PID 2852 wrote to memory of 2380	2852	2024-05-11_0ee3258f1a686bbe6aebafaccaa72fbd_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-11_0ee3258f1a686bbe6aebafaccaa72fbd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-11_0ee3258f1a686bbe6aebafaccaa72fbd_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
65KB

MD5
0a1f82d9d0a856c82395664b3327491f

SHA1
541600891a6d9d5fac3eee2c73f6f3169db808be

SHA256
9c57a09b33d4f7d2765d1900dc957f68b8fbf327ed96087aa53e4f52a1fe7029

SHA512
88e70ddd0350996874267a15ebc931d790466aa7d3d5dce07ce2e2951c3086735566c1c2d53e075dff91d6901a4192f4dbb0329cf9297da358b9b5dbacb8647a

Download Submit
memory/2380-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2380-25-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2380-18-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2852-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2852-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2852-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2852-9-0x0000000077820000-0x00000000779C9000-memory.dmp

Filesize
1.7MB

Download
memory/2852-13-0x0000000002BC0000-0x0000000002BD0000-memory.dmp

Filesize
64KB

Download
memory/2852-16-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download