9bf1414ce4f1afa225f57125c0f015babc14b3ae43c0e21535aa5bd08359e07b

Analysis

max time kernel
129s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3577a91c9136fe32a25b50df31c70593_cryptolocker_JC.exe
Size

45KB
MD5

3577a91c9136fe32a25b50df31c70593
SHA1

577b6076fd91790d38e4856305694ccfddbc9719
SHA256

9bf1414ce4f1afa225f57125c0f015babc14b3ae43c0e21535aa5bd08359e07b
SHA512

7bdec613fd2d623ffcca34a0b266a8668c61da98e414961750e9a78deee58670855f473f23962825dd10513093ed7a4b4accf783f344113e07d502a4895cfc2f
SSDEEP

768:79inqyNR/QtOOtEvwDpjBKp1MiYPP/btdT:79mqyNhQMOtEvwDpjBktYHP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1448	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 1448	4164	3577a91c9136fe32a25b50df31c70593_cryptolocker_JC.exe	86
PID 4164 wrote to memory of 1448	4164	3577a91c9136fe32a25b50df31c70593_cryptolocker_JC.exe	86
PID 4164 wrote to memory of 1448	4164	3577a91c9136fe32a25b50df31c70593_cryptolocker_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\3577a91c9136fe32a25b50df31c70593_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3577a91c9136fe32a25b50df31c70593_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
4e57078fdc4f90b609256e4d892dce81

SHA1
916daf320bf16d55b6ec914d2afafa554be9bfc4

SHA256
6f439900dafa7335aad7b75a2dbf12304c29cfcee34c5c778e49b0bbbc1cebbb

SHA512
00ecbe3948ced80f2cd4afb4f0ac297ee024f53e1dab3208f4988e886ed136f1d23eb6da0882e15ae8bcd333a2da4e40ba14da03fc6d717528e824bdbbaea869

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
4e57078fdc4f90b609256e4d892dce81

SHA1
916daf320bf16d55b6ec914d2afafa554be9bfc4

SHA256
6f439900dafa7335aad7b75a2dbf12304c29cfcee34c5c778e49b0bbbc1cebbb

SHA512
00ecbe3948ced80f2cd4afb4f0ac297ee024f53e1dab3208f4988e886ed136f1d23eb6da0882e15ae8bcd333a2da4e40ba14da03fc6d717528e824bdbbaea869

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
45KB

MD5
4e57078fdc4f90b609256e4d892dce81

SHA1
916daf320bf16d55b6ec914d2afafa554be9bfc4

SHA256
6f439900dafa7335aad7b75a2dbf12304c29cfcee34c5c778e49b0bbbc1cebbb

SHA512
00ecbe3948ced80f2cd4afb4f0ac297ee024f53e1dab3208f4988e886ed136f1d23eb6da0882e15ae8bcd333a2da4e40ba14da03fc6d717528e824bdbbaea869

Download Submit
memory/1448-153-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1448-152-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1448-159-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4164-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4164-134-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4164-135-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4164-136-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/4164-150-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download