Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 01:11

General

  • Target

    2024-06-11_9c4ada962ebdf0f1254afc212c77dd6b_cryptolocker.exe

  • Size

    91KB

  • MD5

    9c4ada962ebdf0f1254afc212c77dd6b

  • SHA1

    adaa1a52cc22be446ba9b936c017be89ff84006d

  • SHA256

    3bb0b983639eb506c05b33dfdec8061b226b3bb6175d559419244634b6949a0e

  • SHA512

    42613b7d8010e7a7e998d455bbe49c1f3a93596164ddcc3c129ab5bc3e0ecc8f5a31f074d0a4bbf6a00c3bdce32e21709a05f69ed3b48debd1d688584d7e8213

  • SSDEEP

    1536:n6QFElP6n+g9u9cvMOtEvwDpjYYTjipvF2bx1PQAyI:n6a+1SEOtEvwDpjYYvQd2PB

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_9c4ada962ebdf0f1254afc212c77dd6b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_9c4ada962ebdf0f1254afc212c77dd6b_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2364
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2736

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\asih.exe

          Filesize

          91KB

          MD5

          e5092896f37d580fe522f4e6239a7aae

          SHA1

          7c03b9ec02a6cd97998029b44a6bfb25b5622f04

          SHA256

          379d81c849374ab0f0f02212bb8d44c919cb4a59d22d248c291efbda4f026eaf

          SHA512

          3d59dec7895d28fdecea6c06cd4ecb0bdfc72e76845ecefcc31addaf7ccd568255c4a8087703bc89cd35b70150634f363f2efbad84ab36eba881ed812ecd179a

        • memory/2364-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

          Filesize

          24KB

        • memory/2364-1-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/2364-3-0x0000000000290000-0x0000000000296000-memory.dmp

          Filesize

          24KB

        • memory/2364-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

          Filesize

          24KB

        • memory/2364-12-0x0000000002220000-0x0000000002230000-memory.dmp

          Filesize

          64KB

        • memory/2736-25-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/2736-24-0x0000000000240000-0x0000000000246000-memory.dmp

          Filesize

          24KB

        • memory/2736-17-0x00000000004B0000-0x00000000004B6000-memory.dmp

          Filesize

          24KB