0fcc2d90ddd8635a514f02412d81dd197e15c42735c54fb1347fdeac46d7280e

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
05/08/2023, 20:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7c7b9288468d4ce568ce478b01a0d4f5_cryptolocker_JC.exe
Size

63KB
MD5

7c7b9288468d4ce568ce478b01a0d4f5
SHA1

b7cf322b8207ca25d25afdb38535d95003484a9c
SHA256

0fcc2d90ddd8635a514f02412d81dd197e15c42735c54fb1347fdeac46d7280e
SHA512

042949aa6560c1618cdf9eda4a5968c5ec47805ff86b6c80f636a8b2d03132ff330595f595935f4b66ed0757aabd73c71836eddef9d671232ab52b838bbd8114
SSDEEP

768:79inqyNR/QtOOtEvwDpjBK/iVTab3GRuv3Vylscetc4mx1BVp:79mqyNhQMOtEvwDpjBPY7xv3gycetO5p

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2532	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2172	7c7b9288468d4ce568ce478b01a0d4f5_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 2532	2172	7c7b9288468d4ce568ce478b01a0d4f5_cryptolocker_JC.exe	28
PID 2172 wrote to memory of 2532	2172	7c7b9288468d4ce568ce478b01a0d4f5_cryptolocker_JC.exe	28
PID 2172 wrote to memory of 2532	2172	7c7b9288468d4ce568ce478b01a0d4f5_cryptolocker_JC.exe	28
PID 2172 wrote to memory of 2532	2172	7c7b9288468d4ce568ce478b01a0d4f5_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\7c7b9288468d4ce568ce478b01a0d4f5_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7c7b9288468d4ce568ce478b01a0d4f5_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
60e2f6dce54f42c0c76d386fb7b1c3a7

SHA1
415e10ac9ed94a57d25aebce26b504fba7549d43

SHA256
60f7845fc9a21ac1191e43fe3e6d1c41248c8435340a08f99aafe2cd4da09854

SHA512
5bb00067107586d7106e55d2f4e5400478f08930f8e0a1574be102f4871f7909ba0f38039a2d1d049dfaadc6744313d6263cc5fd7295d0cc69be76d3387d1e51

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
60e2f6dce54f42c0c76d386fb7b1c3a7

SHA1
415e10ac9ed94a57d25aebce26b504fba7549d43

SHA256
60f7845fc9a21ac1191e43fe3e6d1c41248c8435340a08f99aafe2cd4da09854

SHA512
5bb00067107586d7106e55d2f4e5400478f08930f8e0a1574be102f4871f7909ba0f38039a2d1d049dfaadc6744313d6263cc5fd7295d0cc69be76d3387d1e51

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
63KB

MD5
60e2f6dce54f42c0c76d386fb7b1c3a7

SHA1
415e10ac9ed94a57d25aebce26b504fba7549d43

SHA256
60f7845fc9a21ac1191e43fe3e6d1c41248c8435340a08f99aafe2cd4da09854

SHA512
5bb00067107586d7106e55d2f4e5400478f08930f8e0a1574be102f4871f7909ba0f38039a2d1d049dfaadc6744313d6263cc5fd7295d0cc69be76d3387d1e51

Download Submit
memory/2172-53-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2172-54-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2172-56-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2172-55-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2172-68-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2532-69-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2532-72-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2532-71-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2532-79-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download