Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10-06-2024 20:44

General

  • Target

    2024-06-10_29aeba87c231fdba05ae8d496b0c39d7_cryptolocker.exe

  • Size

    60KB

  • MD5

    29aeba87c231fdba05ae8d496b0c39d7

  • SHA1

    f3db2782488f09b6615e37fad01f22b66367ad19

  • SHA256

    8049504867fa59a61eae620d67ff962c8f7057f1cc851b5f7c56b9292eabe9b6

  • SHA512

    e81de251d4c0601de2ec7d4b470e1c406572f56c171da8aedf67b91b907d6b94520cd199618f6a72d9671e249f7ef841c3f2329f75bb79bdc44d817eae926992

  • SSDEEP

    768:H6LsoEEeegiZPvEhHSG+gk5NQXtckstOOtEvwDpjhBaD3TUogs/VXpAP6pd34:H6QFElP6n+gou9cvMOtEvwDpjCpVXz34

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-10_29aeba87c231fdba05ae8d496b0c39d7_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-10_29aeba87c231fdba05ae8d496b0c39d7_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2316
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:1964

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    61KB

    MD5

    fe490e85e54908a5a21b4420df9b2a57

    SHA1

    97f0908161ce9a4c1478cbfc25bf70bed3df7b98

    SHA256

    9b069c22e9e9e13de88d2a0f2e62b2ecd61ba41a8f8f7d053cb406252c046fe6

    SHA512

    ff36dd6d3778f2e2de14195fb1f96911cfbc9b74dc44b7a99174680c032fb04095eace5f0349450c3409734efa19b13e55f040b24fb3a91e80ff027240bdb39d

  • memory/1964-17-0x00000000004B0000-0x00000000004B6000-memory.dmp

    Filesize

    24KB

  • memory/1964-25-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1964-24-0x0000000000470000-0x0000000000476000-memory.dmp

    Filesize

    24KB

  • memory/2316-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2316-1-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2316-2-0x0000000000350000-0x0000000000356000-memory.dmp

    Filesize

    24KB

  • memory/2316-8-0x0000000000250000-0x0000000000256000-memory.dmp

    Filesize

    24KB

  • memory/2316-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB