b1d69f71c7794dbfa0abb70e4a033969b460407d68c971102f69214812235dd4

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6af88e7fbf9a8a1ac882b101acbdd5bc_cryptolocker_JC.exe
Size

137KB
MD5

6af88e7fbf9a8a1ac882b101acbdd5bc
SHA1

2a29707d1257e30dc4b9684a007f3580202eaaaa
SHA256

b1d69f71c7794dbfa0abb70e4a033969b460407d68c971102f69214812235dd4
SHA512

4dfbed3886b2165a0ab239d2e889fbd3afd3a0e48c648e83339f1a1f3c4c12ff4c1fdf043ac948d076c906996e6d6cd415369ce6f39e34126e1ba10b784bee67
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp699G/T6:z6a+CdOOtEvwDpjczr

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2844	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1188	6af88e7fbf9a8a1ac882b101acbdd5bc_cryptolocker_JC.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1188-55-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1188-66-0x00000000026C0000-0x00000000026D0000-memory.dmp	upx
behavioral1/files/0x0008000000012026-70.dat	upx
behavioral1/files/0x0008000000012026-65.dat	upx
behavioral1/memory/2844-72-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1188-69-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012026-80.dat	upx
behavioral1/memory/2844-81-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 2844	1188	6af88e7fbf9a8a1ac882b101acbdd5bc_cryptolocker_JC.exe	28
PID 1188 wrote to memory of 2844	1188	6af88e7fbf9a8a1ac882b101acbdd5bc_cryptolocker_JC.exe	28
PID 1188 wrote to memory of 2844	1188	6af88e7fbf9a8a1ac882b101acbdd5bc_cryptolocker_JC.exe	28
PID 1188 wrote to memory of 2844	1188	6af88e7fbf9a8a1ac882b101acbdd5bc_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\6af88e7fbf9a8a1ac882b101acbdd5bc_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6af88e7fbf9a8a1ac882b101acbdd5bc_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
137KB

MD5
3a70bf2e0413a64573d960ff227fa979

SHA1
e140ca59c2a2f22cd76194396134451c75415a7f

SHA256
f7cac8b0a410a79b3009609d4ff943f022210fc93e074af173ef0e5674353d91

SHA512
c280d6bf8689b35bcd7372d558d1e83852b103d2b338eee15df6071a7510bf6819c5a66ca09029281749bec5f11848e9eacb9fbcc7fb8c7c962e6ced5e1cce32

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
137KB

MD5
3a70bf2e0413a64573d960ff227fa979

SHA1
e140ca59c2a2f22cd76194396134451c75415a7f

SHA256
f7cac8b0a410a79b3009609d4ff943f022210fc93e074af173ef0e5674353d91

SHA512
c280d6bf8689b35bcd7372d558d1e83852b103d2b338eee15df6071a7510bf6819c5a66ca09029281749bec5f11848e9eacb9fbcc7fb8c7c962e6ced5e1cce32

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
137KB

MD5
3a70bf2e0413a64573d960ff227fa979

SHA1
e140ca59c2a2f22cd76194396134451c75415a7f

SHA256
f7cac8b0a410a79b3009609d4ff943f022210fc93e074af173ef0e5674353d91

SHA512
c280d6bf8689b35bcd7372d558d1e83852b103d2b338eee15df6071a7510bf6819c5a66ca09029281749bec5f11848e9eacb9fbcc7fb8c7c962e6ced5e1cce32

Download Submit
memory/1188-54-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1188-66-0x00000000026C0000-0x00000000026D0000-memory.dmp

Filesize
64KB

Download
memory/1188-55-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1188-56-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1188-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1188-57-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2844-72-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2844-74-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2844-73-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2844-81-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download