Analysis

  • max time kernel
    148s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    14/06/2024, 07:43

General

  • Target

    2024-06-14_722f7b8cc6b978544093bd94c61e5525_cryptolocker.exe

  • Size

    53KB

  • MD5

    722f7b8cc6b978544093bd94c61e5525

  • SHA1

    6ef9f15838bdb69b524e7c6f384a188690479585

  • SHA256

    8b44a05628b2e7a69b924f5990bb63488db0f14ca6ca6a94eddaa0cc38101729

  • SHA512

    c66bef43835d5d5680f97081043893690871d381304c48bd331e9714203f6efebf7223ad1761cccc0b54c91bd1fe5696d9581d0ad62cae83023c74d1377c8a21

  • SSDEEP

    768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YY1J+OTOmb:z6QFElP6n+gKmddpMOtEvwDpj31imb

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-14_722f7b8cc6b978544093bd94c61e5525_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-14_722f7b8cc6b978544093bd94c61e5525_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1936
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:2680

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    53KB

    MD5

    9d581fc7b50055cc6e475316c42e8c74

    SHA1

    c4538f4400031651f6e9593e723fd8ebc1503101

    SHA256

    3c58b4a31941112d1bd0aa421bc292ae8cf180073295ed4150b42cc7a4c34a6f

    SHA512

    4b1c0ba4d7136a72b1ed4f5bb68d0187172dfd9265f2791979eea5cc3cde0e7f4e43af083311a1d49d864e9d7e59a01b619f547d4621efdb9b0b8aca2131e402

  • memory/1936-0-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/1936-1-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/1936-2-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/1936-9-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/1936-15-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2680-16-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/2680-18-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/2680-19-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/2680-26-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB