cc97123c1f58eb06da831a145293b701af07179ebe62affa75783955386fe56d

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f0577977f0956ee1fd47c90e670bde9_cryptolocker_JC.exe
Size

36KB
MD5

7f0577977f0956ee1fd47c90e670bde9
SHA1

bc025e6151605efe6c6f605757d462bb940cf4b8
SHA256

cc97123c1f58eb06da831a145293b701af07179ebe62affa75783955386fe56d
SHA512

a4182cee4ab9aa6d86f33dd000bca3b20da96800ea0f8e0df981f4b03e0667929ea8f2ff37384a2eed4dcc02227d6b209967b3dae404e9ea4cfbe9995c202537
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQLI3J7f5x:V6QFElP6n+gMQMOtEvwDpjeJQyTx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2748	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1700	7f0577977f0956ee1fd47c90e670bde9_cryptolocker_JC.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1700 wrote to memory of 2748	1700	7f0577977f0956ee1fd47c90e670bde9_cryptolocker_JC.exe	28
PID 1700 wrote to memory of 2748	1700	7f0577977f0956ee1fd47c90e670bde9_cryptolocker_JC.exe	28
PID 1700 wrote to memory of 2748	1700	7f0577977f0956ee1fd47c90e670bde9_cryptolocker_JC.exe	28
PID 1700 wrote to memory of 2748	1700	7f0577977f0956ee1fd47c90e670bde9_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\7f0577977f0956ee1fd47c90e670bde9_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7f0577977f0956ee1fd47c90e670bde9_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1700
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2748

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
80ea6e567ecbf0f168b97d2a89c35aa8

SHA1
72ac04e0f46461d0c794dd2d7749ff81b6796628

SHA256
7c318f4e5657096e02baf222a4aa414b347a9990756a2b9737bb8ae72b137f95

SHA512
41cacd316a2f0967a80156f4b0c8442774560ccf04149f6ebc7deca4b2fff91fda520e68096fd276e7f4dbc4f4232ca6020c83023b88bdff718433405ddf9c78

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
80ea6e567ecbf0f168b97d2a89c35aa8

SHA1
72ac04e0f46461d0c794dd2d7749ff81b6796628

SHA256
7c318f4e5657096e02baf222a4aa414b347a9990756a2b9737bb8ae72b137f95

SHA512
41cacd316a2f0967a80156f4b0c8442774560ccf04149f6ebc7deca4b2fff91fda520e68096fd276e7f4dbc4f4232ca6020c83023b88bdff718433405ddf9c78

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
80ea6e567ecbf0f168b97d2a89c35aa8

SHA1
72ac04e0f46461d0c794dd2d7749ff81b6796628

SHA256
7c318f4e5657096e02baf222a4aa414b347a9990756a2b9737bb8ae72b137f95

SHA512
41cacd316a2f0967a80156f4b0c8442774560ccf04149f6ebc7deca4b2fff91fda520e68096fd276e7f4dbc4f4232ca6020c83023b88bdff718433405ddf9c78

Download Submit
memory/1700-54-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1700-55-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/1700-56-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2748-69-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2748-70-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads