9dc5110455a88b5b182dc96ba4a6f7af1c1c255afad5476f9c9707f5812d5e96

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 17:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3b6c113b67123521c886768c1d341dae_cryptolocker_JC.exe
Size

95KB
MD5

3b6c113b67123521c886768c1d341dae
SHA1

dadcd679f243647c72fe8505c6a5a439692850f3
SHA256

9dc5110455a88b5b182dc96ba4a6f7af1c1c255afad5476f9c9707f5812d5e96
SHA512

5546c7dadf3127c599fc7fb4c6905bdb8dbc6fc2babe41b0468d1c2581d0afaf2b15a22506909c646211bb3ad5fb36433e592f8450de57e786b8618a9e9e16c2
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgpQbCJjm:AnBdOOtEvwDpj6zx

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
772	asih.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3140-133-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x0008000000023202-146.dat	upx
behavioral2/files/0x0008000000023202-148.dat	upx
behavioral2/memory/772-150-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x0008000000023202-149.dat	upx
behavioral2/memory/3140-158-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/772-160-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 772	3140	3b6c113b67123521c886768c1d341dae_cryptolocker_JC.exe	85
PID 3140 wrote to memory of 772	3140	3b6c113b67123521c886768c1d341dae_cryptolocker_JC.exe	85
PID 3140 wrote to memory of 772	3140	3b6c113b67123521c886768c1d341dae_cryptolocker_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\3b6c113b67123521c886768c1d341dae_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3b6c113b67123521c886768c1d341dae_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
3207fa9d26ecac2dde2e461b297bbd55

SHA1
011f6788140339aa74c2832a16f981378a531251

SHA256
e78bd6b86769a6416f19ac850cb0c7943523c7722baaacba4d2eac7c376fe9d6

SHA512
c829de004606f3e45a68364aea58aa19029f842876f074f351d1730b2f00af85e756494cef9261bf2b86b24a6fb229508b358702461f64fbfcb3f585a3b612a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
3207fa9d26ecac2dde2e461b297bbd55

SHA1
011f6788140339aa74c2832a16f981378a531251

SHA256
e78bd6b86769a6416f19ac850cb0c7943523c7722baaacba4d2eac7c376fe9d6

SHA512
c829de004606f3e45a68364aea58aa19029f842876f074f351d1730b2f00af85e756494cef9261bf2b86b24a6fb229508b358702461f64fbfcb3f585a3b612a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
3207fa9d26ecac2dde2e461b297bbd55

SHA1
011f6788140339aa74c2832a16f981378a531251

SHA256
e78bd6b86769a6416f19ac850cb0c7943523c7722baaacba4d2eac7c376fe9d6

SHA512
c829de004606f3e45a68364aea58aa19029f842876f074f351d1730b2f00af85e756494cef9261bf2b86b24a6fb229508b358702461f64fbfcb3f585a3b612a2

Download Submit
memory/772-150-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/772-152-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/772-153-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/772-160-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3140-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3140-134-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/3140-135-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/3140-136-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/3140-158-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download