f6291118da66bb4e5534b68484bf55fe28ef9d1b3b12eaabd6b5b03184603193

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2023 18:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

922007ff3bd2182cccfbd475cdd20ee0_cryptolocker_JC.exe
Size

74KB
MD5

922007ff3bd2182cccfbd475cdd20ee0
SHA1

5a8d9e26fd4fdd79b778ac28c132623d69013b59
SHA256

f6291118da66bb4e5534b68484bf55fe28ef9d1b3b12eaabd6b5b03184603193
SHA512

f83436c83f5d0526d17543eff84d5973b3176805742a13c0f0c4eb7162aa6d0b313684ecce2980827716d1303e09398b1a331fc88e0107a78f4a00ac7f96ed1d
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjIHsalDSJj:1nK6a+qdOOtEvwDpjf

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4100	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4136-133-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/files/0x00060000000231d4-146.dat	upx
behavioral2/files/0x00060000000231d4-148.dat	upx
behavioral2/files/0x00060000000231d4-149.dat	upx
behavioral2/memory/4136-150-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/4100-159-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 4100	4136	922007ff3bd2182cccfbd475cdd20ee0_cryptolocker_JC.exe	81
PID 4136 wrote to memory of 4100	4136	922007ff3bd2182cccfbd475cdd20ee0_cryptolocker_JC.exe	81
PID 4136 wrote to memory of 4100	4136	922007ff3bd2182cccfbd475cdd20ee0_cryptolocker_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\922007ff3bd2182cccfbd475cdd20ee0_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\922007ff3bd2182cccfbd475cdd20ee0_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
0e861b24c912ec483691e1edc7e93a76

SHA1
74f429e5a2a9aebc71b0242ce51790909df0b8b4

SHA256
ebd9f9898a809a433d1c2cf9b05788c1211b3d0aa31e9391173c80e9f7266bf8

SHA512
dbb97e6c321519d26af2259f7ec03c4e50fcb4f37c9c5dc4e86e3d0c047f4c48c6b38187a26ac94ebc484cef1b55dda41b07695a1954142665c6177043bf640b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
0e861b24c912ec483691e1edc7e93a76

SHA1
74f429e5a2a9aebc71b0242ce51790909df0b8b4

SHA256
ebd9f9898a809a433d1c2cf9b05788c1211b3d0aa31e9391173c80e9f7266bf8

SHA512
dbb97e6c321519d26af2259f7ec03c4e50fcb4f37c9c5dc4e86e3d0c047f4c48c6b38187a26ac94ebc484cef1b55dda41b07695a1954142665c6177043bf640b

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
74KB

MD5
0e861b24c912ec483691e1edc7e93a76

SHA1
74f429e5a2a9aebc71b0242ce51790909df0b8b4

SHA256
ebd9f9898a809a433d1c2cf9b05788c1211b3d0aa31e9391173c80e9f7266bf8

SHA512
dbb97e6c321519d26af2259f7ec03c4e50fcb4f37c9c5dc4e86e3d0c047f4c48c6b38187a26ac94ebc484cef1b55dda41b07695a1954142665c6177043bf640b

Download Submit
memory/4100-152-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/4100-153-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4100-159-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/4136-133-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/4136-134-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4136-135-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/4136-136-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/4136-150-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download