c2b87534e199168a644523ad4cbabbbe7daa721380592c9e5f3d4edc4f5da7e7

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
03/08/2023, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5578501d23de3267d2416c9b98034861_cryptolocker_JC.exe
Size

40KB
MD5

5578501d23de3267d2416c9b98034861
SHA1

479921f9124504ada0eb48b88a42e56924b16ab0
SHA256

c2b87534e199168a644523ad4cbabbbe7daa721380592c9e5f3d4edc4f5da7e7
SHA512

d0318edc7195b297a960d037c64047698bb6e706d4bbca50a5fa3bcbf77b2ec65f12a98f4d2ad4cce78e4a0b64d5ad9bfa112a1688b59f9b45ea1bd4f7f0afaa
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEq1xGh:X6QFElP6n+gJQMOtEvwDpjB0mGh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
568	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2460	5578501d23de3267d2416c9b98034861_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2460 wrote to memory of 568	2460	5578501d23de3267d2416c9b98034861_cryptolocker_JC.exe	28
PID 2460 wrote to memory of 568	2460	5578501d23de3267d2416c9b98034861_cryptolocker_JC.exe	28
PID 2460 wrote to memory of 568	2460	5578501d23de3267d2416c9b98034861_cryptolocker_JC.exe	28
PID 2460 wrote to memory of 568	2460	5578501d23de3267d2416c9b98034861_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\5578501d23de3267d2416c9b98034861_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5578501d23de3267d2416c9b98034861_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2460
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
40KB

MD5
db270f2f3f81541c2119499fec9bce91

SHA1
ef901f65de56c63448cd8cb11a69c51c3be7e38c

SHA256
2bb0c7051ece4de0a5bc956079e55fcf486b5e9f887bbbe577e762610ecc7432

SHA512
8819499b8fdceccfb6afcdaaf397f6bcd1f5b36ecbc6eaaba23253acdf41aba5ba73c96126842c62666b6f7c0a86472856e71af8dc44f88af89b3dbe30b274a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
40KB

MD5
db270f2f3f81541c2119499fec9bce91

SHA1
ef901f65de56c63448cd8cb11a69c51c3be7e38c

SHA256
2bb0c7051ece4de0a5bc956079e55fcf486b5e9f887bbbe577e762610ecc7432

SHA512
8819499b8fdceccfb6afcdaaf397f6bcd1f5b36ecbc6eaaba23253acdf41aba5ba73c96126842c62666b6f7c0a86472856e71af8dc44f88af89b3dbe30b274a9

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
40KB

MD5
db270f2f3f81541c2119499fec9bce91

SHA1
ef901f65de56c63448cd8cb11a69c51c3be7e38c

SHA256
2bb0c7051ece4de0a5bc956079e55fcf486b5e9f887bbbe577e762610ecc7432

SHA512
8819499b8fdceccfb6afcdaaf397f6bcd1f5b36ecbc6eaaba23253acdf41aba5ba73c96126842c62666b6f7c0a86472856e71af8dc44f88af89b3dbe30b274a9

Download Submit
memory/2460-53-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2460-54-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/2460-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download