a7001ea2c27070aad5cd64568af2dcab406ca22f31e9bfde916ceea53d40cd53

Analysis

max time kernel
133s
max time network
143s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d61289443b211cd1cbb8453dfdae754_cryptolocker_JC.exe
Size

60KB
MD5

8d61289443b211cd1cbb8453dfdae754
SHA1

51c78e498b42d66defa944ac76536e0832ecb07c
SHA256

a7001ea2c27070aad5cd64568af2dcab406ca22f31e9bfde916ceea53d40cd53
SHA512

6b9ad2d24b99f239e591ba33bd02424f4cfaaeba2601302bf68ffeeed31b2f1fd815bfef26d258ea5e625cf91def474147e8d5d7b7092a5f6c189b4bec22e35e
SSDEEP

768:z6LsoEEeegiZPvEhHSG+gzum/kLyMro2GtOOtEvwDpj/YMLam5aFr7YOzzOc:z6QFElP6n+gKmddpMOtEvwDpj9aYaFAM

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1496	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2608	8d61289443b211cd1cbb8453dfdae754_cryptolocker_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2608-54-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0009000000012029-65.dat	upx
behavioral1/files/0x0009000000012029-68.dat	upx
behavioral1/memory/1496-71-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2608-69-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0009000000012029-79.dat	upx
behavioral1/memory/1496-80-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1496	2608	8d61289443b211cd1cbb8453dfdae754_cryptolocker_JC.exe	28
PID 2608 wrote to memory of 1496	2608	8d61289443b211cd1cbb8453dfdae754_cryptolocker_JC.exe	28
PID 2608 wrote to memory of 1496	2608	8d61289443b211cd1cbb8453dfdae754_cryptolocker_JC.exe	28
PID 2608 wrote to memory of 1496	2608	8d61289443b211cd1cbb8453dfdae754_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8d61289443b211cd1cbb8453dfdae754_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8d61289443b211cd1cbb8453dfdae754_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
60KB

MD5
286ba1138da4581b778f6a74be3b8512

SHA1
08bd7cfbfcc1c996a2353b55cef46d2ec4ad9816

SHA256
240ed302e1b2d09caaec0518a5d0560a4d6e12e0e5f08cdf480338133c44e991

SHA512
891bf4dde3b1c6f9958747442bb1f03b29ef4da916fede22931ddc30ab5d6976e130bbfcc75d91b9411be5b5c4e30df55dd46e6f6bcd98f7fecf0dc5758377de

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
60KB

MD5
286ba1138da4581b778f6a74be3b8512

SHA1
08bd7cfbfcc1c996a2353b55cef46d2ec4ad9816

SHA256
240ed302e1b2d09caaec0518a5d0560a4d6e12e0e5f08cdf480338133c44e991

SHA512
891bf4dde3b1c6f9958747442bb1f03b29ef4da916fede22931ddc30ab5d6976e130bbfcc75d91b9411be5b5c4e30df55dd46e6f6bcd98f7fecf0dc5758377de

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
60KB

MD5
286ba1138da4581b778f6a74be3b8512

SHA1
08bd7cfbfcc1c996a2353b55cef46d2ec4ad9816

SHA256
240ed302e1b2d09caaec0518a5d0560a4d6e12e0e5f08cdf480338133c44e991

SHA512
891bf4dde3b1c6f9958747442bb1f03b29ef4da916fede22931ddc30ab5d6976e130bbfcc75d91b9411be5b5c4e30df55dd46e6f6bcd98f7fecf0dc5758377de

Download Submit
memory/1496-71-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1496-73-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1496-72-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/1496-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2608-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2608-55-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2608-56-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2608-58-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2608-69-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download