4fbd34d28d15396d783abcd4a2b95ab5831d570488b5b9944786de5d9ceee7f0

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04-08-2023 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e0a42355cb0e7ea1560a585108d4e07_cryptolocker_JC.exe
Size

88KB
MD5

5e0a42355cb0e7ea1560a585108d4e07
SHA1

b3b4c4065f6e7b1f44517c41775941685cd3f720
SHA256

4fbd34d28d15396d783abcd4a2b95ab5831d570488b5b9944786de5d9ceee7f0
SHA512

012eaae885a954d00fb11b757e0024e840ecb4449253296dec52cc71fae3dda10fb1055d3618202b88305133f7f6b992d84aa0e57c0ba806ca1952ff1aa2378a
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbNcqamvWHShlRR+:V6a+pOtEvwDpjtx+

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2980	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3028	5e0a42355cb0e7ea1560a585108d4e07_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 2980	3028	5e0a42355cb0e7ea1560a585108d4e07_cryptolocker_JC.exe	28
PID 3028 wrote to memory of 2980	3028	5e0a42355cb0e7ea1560a585108d4e07_cryptolocker_JC.exe	28
PID 3028 wrote to memory of 2980	3028	5e0a42355cb0e7ea1560a585108d4e07_cryptolocker_JC.exe	28
PID 3028 wrote to memory of 2980	3028	5e0a42355cb0e7ea1560a585108d4e07_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\5e0a42355cb0e7ea1560a585108d4e07_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5e0a42355cb0e7ea1560a585108d4e07_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
88KB

MD5
fa0d872be949de2a42f0d816a3054276

SHA1
b76481368a186b4ce5475ec8b33d2347b3029526

SHA256
5c6d334d02cac6cbf1d627bb93d8e333dca337c9c167d695de9b2aca69cbe3dd

SHA512
49571d8f68e97242cd84c15794d1b1384aa08288b1084eb964d272338ddb434b8c432c6b4a90c2826f6e46fdfd307e001f377f34b3762d6e0b565a737de81e86

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
88KB

MD5
fa0d872be949de2a42f0d816a3054276

SHA1
b76481368a186b4ce5475ec8b33d2347b3029526

SHA256
5c6d334d02cac6cbf1d627bb93d8e333dca337c9c167d695de9b2aca69cbe3dd

SHA512
49571d8f68e97242cd84c15794d1b1384aa08288b1084eb964d272338ddb434b8c432c6b4a90c2826f6e46fdfd307e001f377f34b3762d6e0b565a737de81e86

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
88KB

MD5
fa0d872be949de2a42f0d816a3054276

SHA1
b76481368a186b4ce5475ec8b33d2347b3029526

SHA256
5c6d334d02cac6cbf1d627bb93d8e333dca337c9c167d695de9b2aca69cbe3dd

SHA512
49571d8f68e97242cd84c15794d1b1384aa08288b1084eb964d272338ddb434b8c432c6b4a90c2826f6e46fdfd307e001f377f34b3762d6e0b565a737de81e86

Download Submit
memory/2980-69-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/2980-70-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3028-54-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/3028-55-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/3028-56-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download