279faf5b917684869eff6d422c679d49ced293295f364b9f784a196af4494738

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240521750217367f13b344a688853cbda504c1cryptolocker.exe
Size

97KB
MD5

750217367f13b344a688853cbda504c1
SHA1

3d509c6a697b6792996a504680fd8df4c12d6c75
SHA256

279faf5b917684869eff6d422c679d49ced293295f364b9f784a196af4494738
SHA512

e5eb3b731405331e97c885cf59099ac8338784f4079b69ee2bbb6d105a9855a9a88057435f3867c478e07d57692fb86c47e5d622dc9b8458cbbc7fc771a4f25a
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp01i:AnBdOOtEvwDpj6zE

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2556 asih.exe
Loads dropped DLL 1 IoCs

Processes:

20240521750217367f13b344a688853cbda504c1cryptolocker.exe

pid process

1680 20240521750217367f13b344a688853cbda504c1cryptolocker.exe

pid	process
2556	asih.exe

pid	process
1680	20240521750217367f13b344a688853cbda504c1cryptolocker.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1680-0-0x0000000000500000-0x000000000050F000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/1680-12-0x0000000002320000-0x000000000232F000-memory.dmp	upx
behavioral1/memory/1680-17-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2556-18-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral1/memory/2556-28-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521750217367f13b344a688853cbda504c1cryptolocker.exe

description	pid	process	target process
PID 1680 wrote to memory of 2556	1680	20240521750217367f13b344a688853cbda504c1cryptolocker.exe	asih.exe
PID 1680 wrote to memory of 2556	1680	20240521750217367f13b344a688853cbda504c1cryptolocker.exe	asih.exe
PID 1680 wrote to memory of 2556	1680	20240521750217367f13b344a688853cbda504c1cryptolocker.exe	asih.exe
PID 1680 wrote to memory of 2556	1680	20240521750217367f13b344a688853cbda504c1cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\20240521750217367f13b344a688853cbda504c1cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521750217367f13b344a688853cbda504c1cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
97KB

MD5
7031aaf3be542578db55daced373265e

SHA1
3207ed6e3d9fcbffe836a1c1adb7ca32737b4c69

SHA256
69950faea21fccbae393d87517311de96bd039901642a7e49c9ddc92eeb46fad

SHA512
ed8661f5746270261cd39ddfcb04e2b9a4920322cf44ad1c954bdea16098627ef4eefc292db1e541e48afcc4d68ceb3d0911f6b5ae47df54ab0304a7b3cfd18b

Download Submit
memory/1680-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1680-1-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1680-2-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1680-9-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1680-12-0x0000000002320000-0x000000000232F000-memory.dmp

Filesize
60KB

Download
memory/1680-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2556-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2556-20-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2556-27-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2556-28-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download