82efcf7c5d20056ffbe2e8585fb59a4209b4ef718ac475d0788ab4c5125fd5f8

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2023, 18:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

919e2124977e5e54de6240904954ac20_cryptolocker_JC.exe
Size

115KB
MD5

919e2124977e5e54de6240904954ac20
SHA1

8fbaae3d559a7a1cf6a53f2eb6b209856c3947aa
SHA256

82efcf7c5d20056ffbe2e8585fb59a4209b4ef718ac475d0788ab4c5125fd5f8
SHA512

a0a033bee1df6832823d225930283b56462b63388fc03a848101f7b5ba3558c247ef2c0f421cc7d8a0549d984a22ccd284ef740e23458f30b6d1c26fa24b5c2b
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgpQbmP:z6a+CdOOtEvwDpjczO

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3036	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3004-133-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x0007000000023232-146.dat	upx
behavioral2/files/0x0007000000023232-148.dat	upx
behavioral2/files/0x0007000000023232-149.dat	upx
behavioral2/memory/3004-150-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/3036-159-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3004 wrote to memory of 3036	3004	919e2124977e5e54de6240904954ac20_cryptolocker_JC.exe	82
PID 3004 wrote to memory of 3036	3004	919e2124977e5e54de6240904954ac20_cryptolocker_JC.exe	82
PID 3004 wrote to memory of 3036	3004	919e2124977e5e54de6240904954ac20_cryptolocker_JC.exe	82

C:\Users\Admin\AppData\Local\Temp\919e2124977e5e54de6240904954ac20_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\919e2124977e5e54de6240904954ac20_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
116KB

MD5
5f920fd6bf9d5b1750456424a88eb42f

SHA1
137c2ace6bc93521ee05ff7719b16eb1c9675b58

SHA256
d39226b1f65bdc80962856a2e2e6d5250ba5550ca1848ba525f8f953287c0091

SHA512
4f5913c8f28689f7a80492a028e2e62a48a2d0ae757bace8ad118dd6e2ba5d3eabdb88307dc99963d989ec41744e933a3ee213e25fa94fd2486405633e12ee41

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
116KB

MD5
5f920fd6bf9d5b1750456424a88eb42f

SHA1
137c2ace6bc93521ee05ff7719b16eb1c9675b58

SHA256
d39226b1f65bdc80962856a2e2e6d5250ba5550ca1848ba525f8f953287c0091

SHA512
4f5913c8f28689f7a80492a028e2e62a48a2d0ae757bace8ad118dd6e2ba5d3eabdb88307dc99963d989ec41744e933a3ee213e25fa94fd2486405633e12ee41

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
116KB

MD5
5f920fd6bf9d5b1750456424a88eb42f

SHA1
137c2ace6bc93521ee05ff7719b16eb1c9675b58

SHA256
d39226b1f65bdc80962856a2e2e6d5250ba5550ca1848ba525f8f953287c0091

SHA512
4f5913c8f28689f7a80492a028e2e62a48a2d0ae757bace8ad118dd6e2ba5d3eabdb88307dc99963d989ec41744e933a3ee213e25fa94fd2486405633e12ee41

Download Submit
memory/3004-133-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3004-134-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/3004-135-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/3004-136-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/3004-150-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3036-152-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3036-153-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3036-159-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download