d51f4b824b7831f36d6356a73ec08904a76abd5e9d85fa9677a3e66ed418c21e

Analysis

max time kernel
149s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2023, 15:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a5fb980a7347bcb07e89163c9bc98b4_cryptolocker_JC.exe
Size

49KB
MD5

8a5fb980a7347bcb07e89163c9bc98b4
SHA1

a1f5de7910329fdbee7ae84ace169782d5efc749
SHA256

d51f4b824b7831f36d6356a73ec08904a76abd5e9d85fa9677a3e66ed418c21e
SHA512

d4104a204659046f8af44d7030b2c5463e37ab2e2e96e7b315d808d04051cfb178a89cfd05368c548f4754b6942a2b5e3b486975aaad0469867793ff5f36f121
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb619:BbdDmjr+OtEvwDpjMr

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3672	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4448 wrote to memory of 3672	4448	8a5fb980a7347bcb07e89163c9bc98b4_cryptolocker_JC.exe	82
PID 4448 wrote to memory of 3672	4448	8a5fb980a7347bcb07e89163c9bc98b4_cryptolocker_JC.exe	82
PID 4448 wrote to memory of 3672	4448	8a5fb980a7347bcb07e89163c9bc98b4_cryptolocker_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\8a5fb980a7347bcb07e89163c9bc98b4_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8a5fb980a7347bcb07e89163c9bc98b4_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4448
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
645b1deef17fdca2cd052b47f40cc74a

SHA1
8d524d9af2348767676a1f21386a2c66a6930bbe

SHA256
ea0e344e6b0ff0babd06fd369f6fc44172c09c4cb3f12119506c9c4a28277d5a

SHA512
833d2ab427e112c7f5863cc9e2e3caedcc94533e33bef1be38b2e326cc1c7a0f0dfc1999135aa803b3ea42bdab19267c83307624ba79d21d7fd8261039a90468

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
645b1deef17fdca2cd052b47f40cc74a

SHA1
8d524d9af2348767676a1f21386a2c66a6930bbe

SHA256
ea0e344e6b0ff0babd06fd369f6fc44172c09c4cb3f12119506c9c4a28277d5a

SHA512
833d2ab427e112c7f5863cc9e2e3caedcc94533e33bef1be38b2e326cc1c7a0f0dfc1999135aa803b3ea42bdab19267c83307624ba79d21d7fd8261039a90468

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
49KB

MD5
645b1deef17fdca2cd052b47f40cc74a

SHA1
8d524d9af2348767676a1f21386a2c66a6930bbe

SHA256
ea0e344e6b0ff0babd06fd369f6fc44172c09c4cb3f12119506c9c4a28277d5a

SHA512
833d2ab427e112c7f5863cc9e2e3caedcc94533e33bef1be38b2e326cc1c7a0f0dfc1999135aa803b3ea42bdab19267c83307624ba79d21d7fd8261039a90468

Download Submit
memory/3672-152-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/3672-151-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3672-159-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4448-133-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4448-134-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/4448-135-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/4448-136-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/4448-153-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download