f421da79d89f6059e57e0a7b12d446ab0f0862657391c7b5690c647c572242e8

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 16:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e244580352acd56e190f0c0a7dd9dec_cryptolocker_JC.exe
Size

33KB
MD5

5e244580352acd56e190f0c0a7dd9dec
SHA1

5ca578747bf80b64e392d7586480777ca9cc653f
SHA256

f421da79d89f6059e57e0a7b12d446ab0f0862657391c7b5690c647c572242e8
SHA512

9f2c282e990da14d9fb8f172a5e8488a9ab7c01b1e9a8ac5c2ee18d3a3d31d515a4dae7c0ab86fe6266a9886bcff582356883226ddce3e5f4b53f48fbd6ae275
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaacK:X6QFElP6n+gJQMOtEvwDpjBsK

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2064	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1728	5e244580352acd56e190f0c0a7dd9dec_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1728 wrote to memory of 2064	1728	5e244580352acd56e190f0c0a7dd9dec_cryptolocker_JC.exe	28
PID 1728 wrote to memory of 2064	1728	5e244580352acd56e190f0c0a7dd9dec_cryptolocker_JC.exe	28
PID 1728 wrote to memory of 2064	1728	5e244580352acd56e190f0c0a7dd9dec_cryptolocker_JC.exe	28
PID 1728 wrote to memory of 2064	1728	5e244580352acd56e190f0c0a7dd9dec_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\5e244580352acd56e190f0c0a7dd9dec_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5e244580352acd56e190f0c0a7dd9dec_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
33KB

MD5
8f54bc02e45bc32072b7cd578e9945a2

SHA1
2d5d8ebb24bf372b9684dc0d6e298088ea86d613

SHA256
ebf6ee1fd49935e69bc3ecdb91e37338dde3472f3f6de2e2c562ad07f58c1300

SHA512
88900c36f990f379bd685cb7f583c35d9f12c369aee0e6d777a58008379e9ca75bb279667695774c182b2c6db761e46903bbfa9aa0de291c311507f6352fcbe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
33KB

MD5
8f54bc02e45bc32072b7cd578e9945a2

SHA1
2d5d8ebb24bf372b9684dc0d6e298088ea86d613

SHA256
ebf6ee1fd49935e69bc3ecdb91e37338dde3472f3f6de2e2c562ad07f58c1300

SHA512
88900c36f990f379bd685cb7f583c35d9f12c369aee0e6d777a58008379e9ca75bb279667695774c182b2c6db761e46903bbfa9aa0de291c311507f6352fcbe6

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
33KB

MD5
8f54bc02e45bc32072b7cd578e9945a2

SHA1
2d5d8ebb24bf372b9684dc0d6e298088ea86d613

SHA256
ebf6ee1fd49935e69bc3ecdb91e37338dde3472f3f6de2e2c562ad07f58c1300

SHA512
88900c36f990f379bd685cb7f583c35d9f12c369aee0e6d777a58008379e9ca75bb279667695774c182b2c6db761e46903bbfa9aa0de291c311507f6352fcbe6

Download Submit
memory/1728-54-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/1728-55-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/1728-56-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2064-69-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2064-70-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download