be4c445922c4f7ecc7436c80b0fdffe4bb105c01b13f5fd954dd7cb395ccd676

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
02/08/2023, 18:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4324716161964d9c6fa43a68bd3f89d1_cryptolocker_JC.exe
Size

73KB
MD5

4324716161964d9c6fa43a68bd3f89d1
SHA1

8efd05c9924ae919f607af31f9e39576ac35fdcf
SHA256

be4c445922c4f7ecc7436c80b0fdffe4bb105c01b13f5fd954dd7cb395ccd676
SHA512

23188b98b54b804a6c6e31e9d7734e5c84b4d812669aefd35b5747bf5e4a54ef9458d698c4ace82754c53a3364c1873fe992ed67c9c9cdbd37ab70c1b1ff1b0a
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalDSJI:1nK6a+qdOOtEvwDpjk

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
544	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2912	4324716161964d9c6fa43a68bd3f89d1_cryptolocker_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2912-53-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0008000000012022-68.dat	upx
behavioral1/memory/2912-67-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/memory/544-69-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0008000000012022-64.dat	upx
behavioral1/files/0x0008000000012022-78.dat	upx
behavioral1/memory/544-79-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2912 wrote to memory of 544	2912	4324716161964d9c6fa43a68bd3f89d1_cryptolocker_JC.exe	28
PID 2912 wrote to memory of 544	2912	4324716161964d9c6fa43a68bd3f89d1_cryptolocker_JC.exe	28
PID 2912 wrote to memory of 544	2912	4324716161964d9c6fa43a68bd3f89d1_cryptolocker_JC.exe	28
PID 2912 wrote to memory of 544	2912	4324716161964d9c6fa43a68bd3f89d1_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4324716161964d9c6fa43a68bd3f89d1_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4324716161964d9c6fa43a68bd3f89d1_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
73KB

MD5
92f2baec8facdba03701da6224054e17

SHA1
ed19de62bd4f92476c8b3435481f1182e5e859da

SHA256
5874ff4a27995461dd2c32f137dbf880afae9a96156f3463d222ad5ce31c1270

SHA512
3ab911db5312f4d1d095667aeccb60b2285e9ed4923aa2c4e82929412e6fcb721938e64f3e652a1b5c52458289ffd46c5a0e38e713d42683ae6b227796a23bc5

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
73KB

MD5
92f2baec8facdba03701da6224054e17

SHA1
ed19de62bd4f92476c8b3435481f1182e5e859da

SHA256
5874ff4a27995461dd2c32f137dbf880afae9a96156f3463d222ad5ce31c1270

SHA512
3ab911db5312f4d1d095667aeccb60b2285e9ed4923aa2c4e82929412e6fcb721938e64f3e652a1b5c52458289ffd46c5a0e38e713d42683ae6b227796a23bc5

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
73KB

MD5
92f2baec8facdba03701da6224054e17

SHA1
ed19de62bd4f92476c8b3435481f1182e5e859da

SHA256
5874ff4a27995461dd2c32f137dbf880afae9a96156f3463d222ad5ce31c1270

SHA512
3ab911db5312f4d1d095667aeccb60b2285e9ed4923aa2c4e82929412e6fcb721938e64f3e652a1b5c52458289ffd46c5a0e38e713d42683ae6b227796a23bc5

Download Submit
memory/544-69-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/544-72-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/544-71-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/544-79-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2912-53-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2912-54-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2912-56-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2912-55-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/2912-67-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download