6b80bf438c7628f41eae903784af8be108fd3b7adc36a2252245b5eff81b5ecf

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 05:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe
Size

52KB
MD5

786b38e53d4972bf571cda145f6710c9
SHA1

f5e7589b6573692d199ce474b55fb55b1bea0cdf
SHA256

6b80bf438c7628f41eae903784af8be108fd3b7adc36a2252245b5eff81b5ecf
SHA512

b584b0c1f636918389c29cf955a476a9f6c72c7637375990830f4e6c5112daac1c6431521ef6ab7b63858199e28888e93c8ebfb5f908cc7db71060534c3d927a
SSDEEP

768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOn1:z6QFElP6n+gKmddpMOtEvwDpj31i1

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000f00000001214d-11.dat	CryptoLocker_rule2
behavioral1/memory/2204-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000f00000001214d-11.dat	CryptoLocker_set1
behavioral1/memory/2204-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000f00000001214d-11.dat	UPX
behavioral1/memory/2204-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2996	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2204	2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2204-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000f00000001214d-11.dat	upx
behavioral1/memory/2204-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2996	2204	2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe	28
PID 2204 wrote to memory of 2996	2204	2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe	28
PID 2204 wrote to memory of 2996	2204	2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe	28
PID 2204 wrote to memory of 2996	2204	2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-14_786b38e53d4972bf571cda145f6710c9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
52KB

MD5
ab5cf5c3031672b68b7a4e8ed2d79201

SHA1
a89733bbcad159afda796561c63a27a7b0b8e21c

SHA256
6b17aa0625fd3e2f8e1d60175ec095ea7cac9e17854eb33f0ab53aaaf2b5adaf

SHA512
ec80d403f5c72f86b1c6692e95ba11d36c1eae5a9ffbfaa7c0deffd3993d2593e0354fd6a81ee1a3456f2b6b73eff401ec11e160c30a410de9ebc34cfec793a8

Download Submit
memory/2204-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2204-1-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2204-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2204-9-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2204-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2996-17-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2996-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2996-24-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download