c41da5ae6c23d6423e1584183b6ef2b7f6f2269845da1fdf7abe7df56c98f9c2

Analysis

max time kernel
4s
max time network
8s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2023, 15:57

Target

8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe
Size

90KB
MD5

8e0b1c264dd056bafaf0c683d8101262
SHA1

3e89fde4097984702bc634942415bef0f89ae974
SHA256

c41da5ae6c23d6423e1584183b6ef2b7f6f2269845da1fdf7abe7df56c98f9c2
SHA512

5de05ed6fab71ab2575021d5daa1066c3852a6b3cd4cd275bf6bfb5b003176610565087b2271b6a35ca44fab0172a59dc69704d01365dcc0e5cb36b795a63e17
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbNcqamvWHShl/3Wsd:V6a+pOtEvwDpjt3

Score

3^/10

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2148 wrote to memory of 4380	2148	8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe	81
PID 2148 wrote to memory of 4380	2148	8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe	81
PID 2148 wrote to memory of 4380	2148	8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\8e0b1c264dd056bafaf0c683d8101262_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2148
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  PID:4380

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
b4e496bee52b62153edfa00c6393f9d1

SHA1
b5f567f9aed816c3d8d1381e6ae60cde53ea3dcb

SHA256
9f758794132ca8578eb4c8a520f0f2226616505900796d6278d3c625091fa5d8

SHA512
6f31e8009b5c5b7571627632d7522520689f3750aab6843e98c622ca15527f2b52acca20eda7fd34616f8fe126538512b92f64c0c04acdfa0106f2486cc234cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
b4e496bee52b62153edfa00c6393f9d1

SHA1
b5f567f9aed816c3d8d1381e6ae60cde53ea3dcb

SHA256
9f758794132ca8578eb4c8a520f0f2226616505900796d6278d3c625091fa5d8

SHA512
6f31e8009b5c5b7571627632d7522520689f3750aab6843e98c622ca15527f2b52acca20eda7fd34616f8fe126538512b92f64c0c04acdfa0106f2486cc234cd

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
90KB

MD5
b4e496bee52b62153edfa00c6393f9d1

SHA1
b5f567f9aed816c3d8d1381e6ae60cde53ea3dcb

SHA256
9f758794132ca8578eb4c8a520f0f2226616505900796d6278d3c625091fa5d8

SHA512
6f31e8009b5c5b7571627632d7522520689f3750aab6843e98c622ca15527f2b52acca20eda7fd34616f8fe126538512b92f64c0c04acdfa0106f2486cc234cd

Download Submit
memory/2148-133-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2148-134-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2148-135-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download