Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 02:29

General

  • Target

    2024-05-22_d32a490a138c9faedca076f736f0f1d7_cryptolocker.exe

  • Size

    40KB

  • MD5

    d32a490a138c9faedca076f736f0f1d7

  • SHA1

    7a8657bfb504b1907effca304a0419bf34b0c5fa

  • SHA256

    60f3802351345f89e95407739f0a3bf9efb3aeb34b58e40783885f45ddf6df7c

  • SHA512

    9fd88a98e0c1ebf42b0e0f1cfc55117020b02456ffeac1cde401763724d2c48a991f24aa09703420a04a0c4d702cd4a1ae04f3bddf306c129ee6b8af6694a0b6

  • SSDEEP

    768:q7PdFecFS5agQtOOtEvwDpjeMLZdzuqpXsiE8Wq/DpkITYaB8u:qDdFJy3QMOtEvwDpjjWMl7TdGu

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_d32a490a138c9faedca076f736f0f1d7_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_d32a490a138c9faedca076f736f0f1d7_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    40KB

    MD5

    94f24fbc714fd38d93ef525002b70461

    SHA1

    542446827653eed8ec51edbd582775b205a9d562

    SHA256

    757d3fac357ac63d93559925ac8f2c9491053ec61871d6dfcfcd6e0067bade32

    SHA512

    38134ba3f0f2a76d5b0b466ab44ed206b94aa24b2b25707cb028d840dddc68cad63afc26ad26e5145d540aeaa5d08d8da0996de325ad53e832c4d901cb3fe03c

  • memory/2060-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2060-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2060-2-0x0000000000300000-0x0000000000306000-memory.dmp

    Filesize

    24KB

  • memory/2060-9-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/2060-13-0x00000000004E0000-0x00000000004F0000-memory.dmp

    Filesize

    64KB

  • memory/2060-17-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2700-19-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2700-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB