Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
21-05-2024 16:04
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe
-
Size
48KB
-
MD5
e876d7dda0a13c369e2cbf256453329b
-
SHA1
3cfd13b5b2736140d11073bbb24e0f4461d0cf0f
-
SHA256
1ebd2d0ab3604a34190578551a008aa481fc9659868af22e7a7894894bdc9471
-
SHA512
d3c8ba1cfd8c032dba6b4527df9830eaf8518d773e9f6e743a539146b4be998ccd56ede4d1e6ae924ab80d01e00f37005cd1b61e9bfb7d25b2e94ee505070ea7
-
SSDEEP
768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmoSQCVUBJUkQqAHBIG05W2MoL5c:qmbhXDmjr5MOtEvwDpj5cDtKkQZQVe
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2656-0-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 \Users\Admin\AppData\Local\Temp\asih.exe CryptoLocker_rule2 behavioral1/memory/2632-16-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2656-15-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 behavioral1/memory/2632-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2656-15-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 behavioral1/memory/2632-26-0x0000000000500000-0x0000000000510000-memory.dmp CryptoLocker_set1 -
UPX dump on OEP (original entry point) 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2656-0-0x0000000000500000-0x0000000000510000-memory.dmp UPX \Users\Admin\AppData\Local\Temp\asih.exe UPX behavioral1/memory/2632-16-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/2656-15-0x0000000000500000-0x0000000000510000-memory.dmp UPX behavioral1/memory/2632-26-0x0000000000500000-0x0000000000510000-memory.dmp UPX -
Executes dropped EXE 1 IoCs
Processes:
asih.exepid process 2632 asih.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exepid process 2656 2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exedescription pid process target process PID 2656 wrote to memory of 2632 2656 2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe asih.exe PID 2656 wrote to memory of 2632 2656 2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe asih.exe PID 2656 wrote to memory of 2632 2656 2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe asih.exe PID 2656 wrote to memory of 2632 2656 2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe asih.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_e876d7dda0a13c369e2cbf256453329b_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\asih.exe"C:\Users\Admin\AppData\Local\Temp\asih.exe"2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\asih.exeFilesize
48KB
MD58a9e617b18c6222252dce95611a0ecaf
SHA18c1a409f2775aa07b475403eee32b3b0e0e1bd62
SHA2561fa194e5b48a7d8d0a104878e4a8af3d38f1196d4a01b6c3266fd4e8081fcebc
SHA51261023f45dbfc76d337fe87961e245db13d4dde4b67b568cc1d87aab0fcb1d62840f5b9a3ef55db3a20a040e8879494e1a3ed77c727254f0cce7941031036c66f
-
memory/2632-16-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/2632-25-0x0000000000240000-0x0000000000246000-memory.dmpFilesize
24KB
-
memory/2632-18-0x0000000000270000-0x0000000000276000-memory.dmpFilesize
24KB
-
memory/2632-26-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/2656-0-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB
-
memory/2656-1-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB
-
memory/2656-9-0x0000000000250000-0x0000000000256000-memory.dmpFilesize
24KB
-
memory/2656-2-0x00000000004E0000-0x00000000004E6000-memory.dmpFilesize
24KB
-
memory/2656-15-0x0000000000500000-0x0000000000510000-memory.dmpFilesize
64KB