625d89121f2e8421260f2f1232efb00d4db8f7eb806ce54f9fef3a812cd5e3f4

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06/08/2023, 15:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b98375a884b034c1f5d6a9111b8bb78_cryptolocker_JC.exe
Size

37KB
MD5

8b98375a884b034c1f5d6a9111b8bb78
SHA1

6b4e072f0a8473ee9dc88890b4dfe6dd84ad8750
SHA256

625d89121f2e8421260f2f1232efb00d4db8f7eb806ce54f9fef3a812cd5e3f4
SHA512

ff5a566523cd4a6d9fca8eaa636e25adf37952eea4e870dd291aa00049168714c67f4f175164ab0ce2fca8579b068e205f7469e3b9c0f134779c24df4ef78bc7
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLaXKq:V6QFElP6n+gMQMOtEvwDpjya3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1524	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	8b98375a884b034c1f5d6a9111b8bb78_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 1524	2060	8b98375a884b034c1f5d6a9111b8bb78_cryptolocker_JC.exe	28
PID 2060 wrote to memory of 1524	2060	8b98375a884b034c1f5d6a9111b8bb78_cryptolocker_JC.exe	28
PID 2060 wrote to memory of 1524	2060	8b98375a884b034c1f5d6a9111b8bb78_cryptolocker_JC.exe	28
PID 2060 wrote to memory of 1524	2060	8b98375a884b034c1f5d6a9111b8bb78_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8b98375a884b034c1f5d6a9111b8bb78_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8b98375a884b034c1f5d6a9111b8bb78_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
e105027e443808526e2cc7d9386ff348

SHA1
47dbe48622c152fb3f59ad914aadc4f28a007e54

SHA256
cf09e4e07d628b43bb72161e90acf72232df83b28431d88203150ce28b91f914

SHA512
43cee16b89a1e669b2c76603f253d319360fcb01b40e971c54c4b85ae74d495be2195a89459d0261a6660fdc39ee859f06cc435efd6ad1ecd5db3e3685e20304

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
e105027e443808526e2cc7d9386ff348

SHA1
47dbe48622c152fb3f59ad914aadc4f28a007e54

SHA256
cf09e4e07d628b43bb72161e90acf72232df83b28431d88203150ce28b91f914

SHA512
43cee16b89a1e669b2c76603f253d319360fcb01b40e971c54c4b85ae74d495be2195a89459d0261a6660fdc39ee859f06cc435efd6ad1ecd5db3e3685e20304

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
e105027e443808526e2cc7d9386ff348

SHA1
47dbe48622c152fb3f59ad914aadc4f28a007e54

SHA256
cf09e4e07d628b43bb72161e90acf72232df83b28431d88203150ce28b91f914

SHA512
43cee16b89a1e669b2c76603f253d319360fcb01b40e971c54c4b85ae74d495be2195a89459d0261a6660fdc39ee859f06cc435efd6ad1ecd5db3e3685e20304

Download Submit
memory/1524-70-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1524-69-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2060-54-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2060-55-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2060-56-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download