e4fc241496bd0c1ff886bbb7560fce1e1797e3b2d89e39e5c9895a3e6e6d83a5

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 00:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe
Size

60KB
MD5

10b25386bc32e25f67bc03a4f4ed7ce9
SHA1

2052c3bd6e94b75619779b2c8a5bf24a6ab4c160
SHA256

e4fc241496bd0c1ff886bbb7560fce1e1797e3b2d89e39e5c9895a3e6e6d83a5
SHA512

910c8e98ff799dfc4ff7fc50246e3fa8b4a8b12ae3c7ff670a4f0a66647bf53445c8f333de6a4ed86bde068b7002e3cc904407019fa21886202febfd7d448763
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj9aYaUf3y:z6a+CdOOtEvwDpjQ1

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2212-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2356-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2212-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2212-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2356-15-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2212-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2212-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2356-15-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/2212-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2212 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe

pid process

2356 2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe

pid	process
2212	asih.exe

pid	process
2356	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2356-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/2212-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2356-15-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2212-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe

description	pid	process	target process
PID 2356 wrote to memory of 2212	2356	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe	asih.exe
PID 2356 wrote to memory of 2212	2356	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe	asih.exe
PID 2356 wrote to memory of 2212	2356	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe	asih.exe
PID 2356 wrote to memory of 2212	2356	2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_10b25386bc32e25f67bc03a4f4ed7ce9_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2212

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
61KB

MD5
872745d29ea33d2da258d60bbbbbb7de

SHA1
9cc7fa9974013397506c33be29b1ca11361d2565

SHA256
19a2944911f1ffc12d2b1aabb85fd85c119fe576815e9a8075241353846fbf58

SHA512
8ff3143cafcf4cc4281021add9e627aeadaa22ba0d8890ded0c45755f3fbb47d317765f4463fd7bdfd4c53b6fc995b9c316cd3465e0e8a8cda3f97819ace5fde

Download Submit
memory/2212-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2212-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2356-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2356-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2356-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2356-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2356-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download