3ed064049902a70f6dbd125b19c8872083e8f37eaef1d8719434c3d3e871a477

Analysis

max time kernel
135s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
03-08-2023 16:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4e469c28041ec163cfdf3a83c5e8f0a8_cryptolocker_JC.exe
Size

94KB
MD5

4e469c28041ec163cfdf3a83c5e8f0a8
SHA1

f6382f4cdeea5e3e15996b65a726fae0e9f5c65f
SHA256

3ed064049902a70f6dbd125b19c8872083e8f37eaef1d8719434c3d3e871a477
SHA512

865714b245cc46a1242ead2d38545365e75ad24190ce988945096bd07fc71d904d68a6de59c3ab005682492c5b456e9fa72211075dc53e698a1357fc3af18e12
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNuj2GQi82W:V6a+pOtEvwDpjtzH

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2228	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1516	4e469c28041ec163cfdf3a83c5e8f0a8_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2228	1516	4e469c28041ec163cfdf3a83c5e8f0a8_cryptolocker_JC.exe	28
PID 1516 wrote to memory of 2228	1516	4e469c28041ec163cfdf3a83c5e8f0a8_cryptolocker_JC.exe	28
PID 1516 wrote to memory of 2228	1516	4e469c28041ec163cfdf3a83c5e8f0a8_cryptolocker_JC.exe	28
PID 1516 wrote to memory of 2228	1516	4e469c28041ec163cfdf3a83c5e8f0a8_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\4e469c28041ec163cfdf3a83c5e8f0a8_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4e469c28041ec163cfdf3a83c5e8f0a8_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
b5d08e369851ec21f6a552960d548d2b

SHA1
36b6882fdd0ce0ff6c3ec16785c847e72369fa23

SHA256
5a2f20847a9008ea37e36ba5b76befb6bae54834b8fec8d970162578e5b54e0b

SHA512
5232b1f2e56034c605d8d71bd26d95fd97a75cf9dce93109df3b4d97c277146968a924f27feee7b682d9cda9317ce8414ffa9e6bfd56d33454932795f9e38674

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
b5d08e369851ec21f6a552960d548d2b

SHA1
36b6882fdd0ce0ff6c3ec16785c847e72369fa23

SHA256
5a2f20847a9008ea37e36ba5b76befb6bae54834b8fec8d970162578e5b54e0b

SHA512
5232b1f2e56034c605d8d71bd26d95fd97a75cf9dce93109df3b4d97c277146968a924f27feee7b682d9cda9317ce8414ffa9e6bfd56d33454932795f9e38674

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
95KB

MD5
b5d08e369851ec21f6a552960d548d2b

SHA1
36b6882fdd0ce0ff6c3ec16785c847e72369fa23

SHA256
5a2f20847a9008ea37e36ba5b76befb6bae54834b8fec8d970162578e5b54e0b

SHA512
5232b1f2e56034c605d8d71bd26d95fd97a75cf9dce93109df3b4d97c277146968a924f27feee7b682d9cda9317ce8414ffa9e6bfd56d33454932795f9e38674

Download Submit
memory/1516-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1516-55-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1516-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2228-69-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2228-70-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download