c41da5ae6c23d6423e1584183b6ef2b7f6f2269845da1fdf7abe7df56c98f9c2

Analysis

max time kernel
148s
max time network
151s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
06-08-2023 15:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe
Size

90KB
MD5

8e0b1c264dd056bafaf0c683d8101262
SHA1

3e89fde4097984702bc634942415bef0f89ae974
SHA256

c41da5ae6c23d6423e1584183b6ef2b7f6f2269845da1fdf7abe7df56c98f9c2
SHA512

5de05ed6fab71ab2575021d5daa1066c3852a6b3cd4cd275bf6bfb5b003176610565087b2271b6a35ca44fab0172a59dc69704d01365dcc0e5cb36b795a63e17
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbNcqamvWHShl/3Wsd:V6a+pOtEvwDpjt3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
544	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3024	8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 544	3024	8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe	28
PID 3024 wrote to memory of 544	3024	8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe	28
PID 3024 wrote to memory of 544	3024	8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe	28
PID 3024 wrote to memory of 544	3024	8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
b4e496bee52b62153edfa00c6393f9d1

SHA1
b5f567f9aed816c3d8d1381e6ae60cde53ea3dcb

SHA256
9f758794132ca8578eb4c8a520f0f2226616505900796d6278d3c625091fa5d8

SHA512
6f31e8009b5c5b7571627632d7522520689f3750aab6843e98c622ca15527f2b52acca20eda7fd34616f8fe126538512b92f64c0c04acdfa0106f2486cc234cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
b4e496bee52b62153edfa00c6393f9d1

SHA1
b5f567f9aed816c3d8d1381e6ae60cde53ea3dcb

SHA256
9f758794132ca8578eb4c8a520f0f2226616505900796d6278d3c625091fa5d8

SHA512
6f31e8009b5c5b7571627632d7522520689f3750aab6843e98c622ca15527f2b52acca20eda7fd34616f8fe126538512b92f64c0c04acdfa0106f2486cc234cd

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
b4e496bee52b62153edfa00c6393f9d1

SHA1
b5f567f9aed816c3d8d1381e6ae60cde53ea3dcb

SHA256
9f758794132ca8578eb4c8a520f0f2226616505900796d6278d3c625091fa5d8

SHA512
6f31e8009b5c5b7571627632d7522520689f3750aab6843e98c622ca15527f2b52acca20eda7fd34616f8fe126538512b92f64c0c04acdfa0106f2486cc234cd

Download Submit
memory/544-69-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/544-68-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/3024-53-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/3024-54-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/3024-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download