40792b9e867a73eccb2a5dd7b069608c1b33c31755ee310b0b27f6f13e214b62

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24-05-2024 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe
Size

64KB
MD5

f85f8aed872b9d76f6e2f7d13fdc4efd
SHA1

1b4a3e25ab17d8c94012a56f9e141075deb60f98
SHA256

40792b9e867a73eccb2a5dd7b069608c1b33c31755ee310b0b27f6f13e214b62
SHA512

abb5390c5bf3e90cb5082d3416194818da6169ddf4f6532c291978c263cd447d8891a3af1f6b7381cba05429330d4d4288b8ef5e562092a1f62c37c9138b9826
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYZ8xK:1nK6a+qdOOtEvwDpjA

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_rule2
behavioral1/memory/2440-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2836-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
\Users\Admin\AppData\Local\Temp\asih.exe	CryptoLocker_set1
behavioral1/memory/2440-16-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1
behavioral1/memory/2836-26-0x0000000000500000-0x000000000050F311-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\asih.exe	UPX
behavioral1/memory/2440-16-0x0000000000500000-0x000000000050F311-memory.dmp	UPX
behavioral1/memory/2836-26-0x0000000000500000-0x000000000050F311-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2836 asih.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe

pid process

2440 2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe

pid	process
2836	asih.exe

pid	process
2440	2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2440-0-0x0000000000500000-0x000000000050F311-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\asih.exe	upx
behavioral1/memory/2440-16-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/2836-26-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe

description	pid	process	target process
PID 2440 wrote to memory of 2836	2440	2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe	asih.exe
PID 2440 wrote to memory of 2836	2440	2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe	asih.exe
PID 2440 wrote to memory of 2836	2440	2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe	asih.exe
PID 2440 wrote to memory of 2836	2440	2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_f85f8aed872b9d76f6e2f7d13fdc4efd_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
2⤵
- Executes dropped EXE
PID:2836

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe
Filesize
64KB

MD5
fb3b4b4cc6cd232ad6ef57da8fc1d45a

SHA1
730f8349e7bd5e5ccdd91da296cde1af4f163575

SHA256
e54b55843dea0908c117a4d2c8a2f8874c9c1188520cfe09ebaa68f2acf43aee

SHA512
4679a17992eb68416f5a4d8a19407ff7dd0d03ed0287e85da352191e97659b42a73f83b8ce089988e958ab595c77d07d4b1c5e893b15a5ed6e2441bb6abbcd5e

Download Submit
memory/2440-0-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2440-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2440-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2440-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2440-13-0x0000000001F10000-0x0000000001F20000-memory.dmp

Filesize
64KB

Download
memory/2440-16-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2836-26-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2836-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2836-18-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download