85a2e9adc4337274af4895d689666065efaa0601304c4ae7d73967ca560b52d5

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 04:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe
Size

60KB
MD5

50f1607cfa5f90fe605d50fe9ffbb2b3
SHA1

dbbe62cb545d1580620bcaa187a9bac37bdaef3a
SHA256

85a2e9adc4337274af4895d689666065efaa0601304c4ae7d73967ca560b52d5
SHA512

bcd22cb4a2d80ed341557c8ce83eed02ceff7d272e630391093d965f48a2f3454dbb36bedbf91b2139d990fc86d39db00061453543af21cd9b68d6529e30727f
SSDEEP

768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAP6p7:H6QFElP6n+gou9cvMOtEvwDpjCpVXV

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000014454-11.dat	CryptoLocker_rule2
behavioral1/memory/2336-13-0x0000000001DA0000-0x0000000001DB0000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2336-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/files/0x000c000000014454-11.dat	CryptoLocker_set1
behavioral1/memory/2336-13-0x0000000001DA0000-0x0000000001DB0000-memory.dmp	CryptoLocker_set1
behavioral1/memory/2336-16-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral1/memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/files/0x000c000000014454-11.dat	UPX
behavioral1/memory/2336-13-0x0000000001DA0000-0x0000000001DB0000-memory.dmp	UPX
behavioral1/memory/2336-16-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral1/memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1648	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2336	2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2336-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x000c000000014454-11.dat	upx
behavioral1/memory/2336-13-0x0000000001DA0000-0x0000000001DB0000-memory.dmp	upx
behavioral1/memory/2336-16-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 1648	2336	2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe	28
PID 2336 wrote to memory of 1648	2336	2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe	28
PID 2336 wrote to memory of 1648	2336	2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe	28
PID 2336 wrote to memory of 1648	2336	2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_50f1607cfa5f90fe605d50fe9ffbb2b3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
60KB

MD5
5e25f34017d0aaa281755a9d293eac3c

SHA1
1d425eaab27931271d6a6bf37832b9e253854eba

SHA256
142a147b3a1a2230d13773ca0b69428f860ccacff0bb1381fe7bf41da6d12e71

SHA512
294edf1f8aa80b0d390154880f5ceaed2c4a62a91291156e56d38530faf6e038dd3039149f2a3265e93751a551dd60c23f377c02e28adf6582ad8873e75a60ec

Download Submit
memory/1648-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1648-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2336-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2336-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2336-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2336-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2336-13-0x0000000001DA0000-0x0000000001DB0000-memory.dmp

Filesize
64KB

Download
memory/2336-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download