d2cf4135cc0a312229b24936b4bcac3c1ddc8e6d1913dc21e3d3641c7e94f158

Analysis

max time kernel
150s
max time network
141s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 17:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

662ba277d9a639d651902132dfe10a59_cryptolocker_JC.exe
Size

77KB
MD5

662ba277d9a639d651902132dfe10a59
SHA1

eb9d5a09c3f7a7e69d9d16b61996f513c753b40a
SHA256

d2cf4135cc0a312229b24936b4bcac3c1ddc8e6d1913dc21e3d3641c7e94f158
SHA512

ec5488dc83e257f17e2e674e67321de0d48a40c7d35c9b495436bad322b0572170ccfd778cdf333a4364919251a1d5fdc0e510c1872dba80040d9e9ef6fff862
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalDSnUK:1nK6a+qdOOtEvwDpjN

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2424	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2440	662ba277d9a639d651902132dfe10a59_cryptolocker_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2440-54-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0009000000012023-65.dat	upx
behavioral1/memory/2440-68-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0009000000012023-70.dat	upx
behavioral1/memory/2424-71-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral1/files/0x0009000000012023-79.dat	upx
behavioral1/memory/2424-81-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 2424	2440	662ba277d9a639d651902132dfe10a59_cryptolocker_JC.exe	28
PID 2440 wrote to memory of 2424	2440	662ba277d9a639d651902132dfe10a59_cryptolocker_JC.exe	28
PID 2440 wrote to memory of 2424	2440	662ba277d9a639d651902132dfe10a59_cryptolocker_JC.exe	28
PID 2440 wrote to memory of 2424	2440	662ba277d9a639d651902132dfe10a59_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\662ba277d9a639d651902132dfe10a59_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\662ba277d9a639d651902132dfe10a59_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
d117f5000f0541f058fae6887981cd61

SHA1
27df42e1b3dd3dd42038a907fabe2336f9a334fa

SHA256
69fe889bc3b0c41bc7437a94866b7d5b4cf43852c72ce2f9fb8eae972d09c31c

SHA512
c29a41b454b7b12e4dc644652af8221d9d5e5b1991805f65a2fc3ca682ce3a8fdcc8ecdcdf01aac71442fab9fd80d94bca003865a1979827b180e614de827e70

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
d117f5000f0541f058fae6887981cd61

SHA1
27df42e1b3dd3dd42038a907fabe2336f9a334fa

SHA256
69fe889bc3b0c41bc7437a94866b7d5b4cf43852c72ce2f9fb8eae972d09c31c

SHA512
c29a41b454b7b12e4dc644652af8221d9d5e5b1991805f65a2fc3ca682ce3a8fdcc8ecdcdf01aac71442fab9fd80d94bca003865a1979827b180e614de827e70

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
77KB

MD5
d117f5000f0541f058fae6887981cd61

SHA1
27df42e1b3dd3dd42038a907fabe2336f9a334fa

SHA256
69fe889bc3b0c41bc7437a94866b7d5b4cf43852c72ce2f9fb8eae972d09c31c

SHA512
c29a41b454b7b12e4dc644652af8221d9d5e5b1991805f65a2fc3ca682ce3a8fdcc8ecdcdf01aac71442fab9fd80d94bca003865a1979827b180e614de827e70

Download Submit
memory/2424-81-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2424-73-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2424-71-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2440-56-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2440-69-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/2440-68-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2440-54-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/2440-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2440-80-0x0000000002480000-0x0000000002490000-memory.dmp

Filesize
64KB

Download
memory/2440-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download