0d6a269cb229edbec7f96bd9941779299bc9c34c18ee0c9ddb0fd17ede0f1906

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
13/05/2024, 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-13_3c21ec1c1b17c208be6555fad049c59a_cryptolocker.exe
Size

66KB
MD5

3c21ec1c1b17c208be6555fad049c59a
SHA1

288e79a1016f35efff6f96e48c6b6b9ca5f65707
SHA256

0d6a269cb229edbec7f96bd9941779299bc9c34c18ee0c9ddb0fd17ede0f1906
SHA512

8a70f7369f15c690515640eb4b256f1727a014bcb44044742cd81a66851e82b5e93ad6b35ec6d77c690ae8d7ac65e912e0ed33af466c8b753434de587eb184ab
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYZ8xg0:1nK6a+qdOOtEvwDpjF

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1640-8-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c0000000167ef-11.dat	CryptoLocker_rule2
behavioral1/memory/1640-14-0x00000000006D0000-0x00000000006E0000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2936-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2936-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/1640-8-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c0000000167ef-11.dat	CryptoLocker_set1
behavioral1/memory/1640-14-0x00000000006D0000-0x00000000006E0000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2936-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/2936-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/1640-8-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/files/0x000c0000000167ef-11.dat	UPX
behavioral1/memory/1640-14-0x00000000006D0000-0x00000000006E0000-memory.dmp	UPX
behavioral1/memory/2936-16-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/2936-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2936	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1640	2024-05-13_3c21ec1c1b17c208be6555fad049c59a_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1640-8-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x000c0000000167ef-11.dat	upx
behavioral1/memory/1640-14-0x00000000006D0000-0x00000000006E0000-memory.dmp	upx
behavioral1/memory/2936-16-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2936-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 2936	1640	2024-05-13_3c21ec1c1b17c208be6555fad049c59a_cryptolocker.exe	28
PID 1640 wrote to memory of 2936	1640	2024-05-13_3c21ec1c1b17c208be6555fad049c59a_cryptolocker.exe	28
PID 1640 wrote to memory of 2936	1640	2024-05-13_3c21ec1c1b17c208be6555fad049c59a_cryptolocker.exe	28
PID 1640 wrote to memory of 2936	1640	2024-05-13_3c21ec1c1b17c208be6555fad049c59a_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-13_3c21ec1c1b17c208be6555fad049c59a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-13_3c21ec1c1b17c208be6555fad049c59a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
66KB

MD5
6e24ea7d1476687b051c58dabe71c924

SHA1
f576f78956555bbbfc3187cec4403321eb166372

SHA256
375a33313a4c5fdc224b579d51f9dfb8f24f4cad30d20232157b7e323bcfcabf

SHA512
2c5304d259ecac4468a62462d1a2275e4427b76930ec9ee847f67d8ebf0423c95a5677b9ec5f447c9e99e66654fea36c597bf99a87c064250b75ec2e98053d95

Download Submit
memory/1640-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1640-1-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1640-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1640-8-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1640-14-0x00000000006D0000-0x00000000006E0000-memory.dmp

Filesize
64KB

Download
memory/2936-16-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2936-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2936-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2936-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download