3ed7900cbb05b61a17eff58385a3e9597b3d70f51a4d135ccb9057fe8ead90a7

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 16:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a08761bc09fb0995d302814572d6379_cryptolocker_JC.exe
Size

64KB
MD5

3a08761bc09fb0995d302814572d6379
SHA1

9042b79febf80794d81c7de2eda565823d2e2230
SHA256

3ed7900cbb05b61a17eff58385a3e9597b3d70f51a4d135ccb9057fe8ead90a7
SHA512

63a30d13017c62d2a343b916ccd22f1e9dad7320d5368c41c4b69f7652c44535773a68e2a6961b706fccb44392bba9bcb5662e618a5efe96f4dd47a2b6172d31
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPtI07HV72H:V6QFElP6n+gMQMOtEvwDpjyaLccVpRSH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2456	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2676	3a08761bc09fb0995d302814572d6379_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 2456	2676	3a08761bc09fb0995d302814572d6379_cryptolocker_JC.exe	28
PID 2676 wrote to memory of 2456	2676	3a08761bc09fb0995d302814572d6379_cryptolocker_JC.exe	28
PID 2676 wrote to memory of 2456	2676	3a08761bc09fb0995d302814572d6379_cryptolocker_JC.exe	28
PID 2676 wrote to memory of 2456	2676	3a08761bc09fb0995d302814572d6379_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\3a08761bc09fb0995d302814572d6379_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3a08761bc09fb0995d302814572d6379_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
315ef309572c6fa9a0c824027278755c

SHA1
72de35fe628326467c4c573c2bddc7e3f240758b

SHA256
934506be23ea7318eaa776b4c19682f81329f1677d883d593acfb774563f1584

SHA512
b0e5ff1917aa598515e854abd19a8bfe56b923c1961030e10c1d40aa2a1ad46332145f3b7447887bb7d93c4b4ec487d23c9245bf371f804027c1719ed131da4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
315ef309572c6fa9a0c824027278755c

SHA1
72de35fe628326467c4c573c2bddc7e3f240758b

SHA256
934506be23ea7318eaa776b4c19682f81329f1677d883d593acfb774563f1584

SHA512
b0e5ff1917aa598515e854abd19a8bfe56b923c1961030e10c1d40aa2a1ad46332145f3b7447887bb7d93c4b4ec487d23c9245bf371f804027c1719ed131da4e

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
315ef309572c6fa9a0c824027278755c

SHA1
72de35fe628326467c4c573c2bddc7e3f240758b

SHA256
934506be23ea7318eaa776b4c19682f81329f1677d883d593acfb774563f1584

SHA512
b0e5ff1917aa598515e854abd19a8bfe56b923c1961030e10c1d40aa2a1ad46332145f3b7447887bb7d93c4b4ec487d23c9245bf371f804027c1719ed131da4e

Download Submit
memory/2456-69-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2456-70-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2676-54-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2676-55-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2676-57-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download