aa9e909e13b81557ccbe5e83a6592ef6bc93a0675103d9c5a63b814b29174fa1

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2023, 18:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

43e282bc4d2f1017f2126a22ab3fb41f_cryptolocker_JC.exe
Size

115KB
MD5

43e282bc4d2f1017f2126a22ab3fb41f
SHA1

b24b90982b04bc7d67490161b5c54413e31888ae
SHA256

aa9e909e13b81557ccbe5e83a6592ef6bc93a0675103d9c5a63b814b29174fa1
SHA512

6c29de1dfd55be9be08bd0b1472761c32645139df34d9b26e73f0e4c18f933491ac5e3ee02d9fdce8b5bf8f3e5dd8a5d9445caa5eb311e937cd2cb001d427e57
SSDEEP

1536:qkmnpomddpMOtEvwDpjJGYQbN/PKwNgp699G/TGul:AnBdOOtEvwDpj6zi

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3436	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/672-133-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/files/0x0007000000023205-146.dat	upx
behavioral2/files/0x0007000000023205-148.dat	upx
behavioral2/files/0x0007000000023205-149.dat	upx
behavioral2/memory/672-151-0x0000000000500000-0x000000000050F000-memory.dmp	upx
behavioral2/memory/3436-159-0x0000000000500000-0x000000000050F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 672 wrote to memory of 3436	672	43e282bc4d2f1017f2126a22ab3fb41f_cryptolocker_JC.exe	86
PID 672 wrote to memory of 3436	672	43e282bc4d2f1017f2126a22ab3fb41f_cryptolocker_JC.exe	86
PID 672 wrote to memory of 3436	672	43e282bc4d2f1017f2126a22ab3fb41f_cryptolocker_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\43e282bc4d2f1017f2126a22ab3fb41f_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\43e282bc4d2f1017f2126a22ab3fb41f_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:672
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
115KB

MD5
0e8382ab705bf02321a85116d266e384

SHA1
e01eafd07bea349b939ec35c340232a52f13ae5e

SHA256
66ce70b1f25359f5412c1354e94b4bd8bb1d420f56ee06a1b2494266a09795d0

SHA512
b3adae26d2ff49719dc88ece5fa3324c5a716eb26411f5f1e59e68cc6334cb8daed98aac27aff9d984a28cfe0b42bbe1a5cfc2a90125c11fe7c4c38527f37e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
115KB

MD5
0e8382ab705bf02321a85116d266e384

SHA1
e01eafd07bea349b939ec35c340232a52f13ae5e

SHA256
66ce70b1f25359f5412c1354e94b4bd8bb1d420f56ee06a1b2494266a09795d0

SHA512
b3adae26d2ff49719dc88ece5fa3324c5a716eb26411f5f1e59e68cc6334cb8daed98aac27aff9d984a28cfe0b42bbe1a5cfc2a90125c11fe7c4c38527f37e6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
115KB

MD5
0e8382ab705bf02321a85116d266e384

SHA1
e01eafd07bea349b939ec35c340232a52f13ae5e

SHA256
66ce70b1f25359f5412c1354e94b4bd8bb1d420f56ee06a1b2494266a09795d0

SHA512
b3adae26d2ff49719dc88ece5fa3324c5a716eb26411f5f1e59e68cc6334cb8daed98aac27aff9d984a28cfe0b42bbe1a5cfc2a90125c11fe7c4c38527f37e6d

Download Submit
memory/672-133-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/672-134-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/672-135-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/672-136-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/672-151-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3436-152-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/3436-153-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3436-159-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download