Analysis

  • max time kernel
    138s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/08/2023, 17:49

General

  • Target

    9eabe3f3fb7907dcdb9a809855c1d969_cryptolocker_JC.exe

  • Size

    84KB

  • MD5

    9eabe3f3fb7907dcdb9a809855c1d969

  • SHA1

    8d1e3a056440ca9d00084c7a12f6301836774139

  • SHA256

    7e8156c2941c1942769d385b5697577216f19514802a8e5975d42cb8f9a89fd1

  • SHA512

    58435e3058b9fc21d8d7066cfd0f88a4fb051745d321af5de7075ca89982cb0008f3a3bdb909c65e719dd798da562bda1f3b8594205000494249ed3bf13abf76

  • SSDEEP

    1536:T6QFElP6n+gxmddpMOtEvwDpjwaxTNUOTzciJjHGlxsLs:T6a+rdOOtEvwDpjNw3

Score
7/10
upx

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • UPX packed file 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9eabe3f3fb7907dcdb9a809855c1d969_cryptolocker_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\9eabe3f3fb7907dcdb9a809855c1d969_cryptolocker_JC.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4308
    • C:\Users\Admin\AppData\Local\Temp\asih.exe
      "C:\Users\Admin\AppData\Local\Temp\asih.exe"
      2⤵
      • Executes dropped EXE
      PID:4912

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    85KB

    MD5

    4990053e71bdef9570540bab67c69c2b

    SHA1

    5be574c8aeaddc598425da87d150a077482ee59b

    SHA256

    21b2be76ab9840ffa2f79a6733a3558ffe79d5bbb968b7dea33bd8635cafc777

    SHA512

    18681adb30c701cc0eeb28dbb79912f9d2431010f7a74d041b01326e0a65324828d2aec75eecfdb246aac8a965c685d7e3645e00abb14954c2b70b55210df008

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    85KB

    MD5

    4990053e71bdef9570540bab67c69c2b

    SHA1

    5be574c8aeaddc598425da87d150a077482ee59b

    SHA256

    21b2be76ab9840ffa2f79a6733a3558ffe79d5bbb968b7dea33bd8635cafc777

    SHA512

    18681adb30c701cc0eeb28dbb79912f9d2431010f7a74d041b01326e0a65324828d2aec75eecfdb246aac8a965c685d7e3645e00abb14954c2b70b55210df008

  • C:\Users\Admin\AppData\Local\Temp\asih.exe

    Filesize

    85KB

    MD5

    4990053e71bdef9570540bab67c69c2b

    SHA1

    5be574c8aeaddc598425da87d150a077482ee59b

    SHA256

    21b2be76ab9840ffa2f79a6733a3558ffe79d5bbb968b7dea33bd8635cafc777

    SHA512

    18681adb30c701cc0eeb28dbb79912f9d2431010f7a74d041b01326e0a65324828d2aec75eecfdb246aac8a965c685d7e3645e00abb14954c2b70b55210df008

  • memory/4308-133-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4308-134-0x00000000007B0000-0x00000000007B6000-memory.dmp

    Filesize

    24KB

  • memory/4308-135-0x00000000007B0000-0x00000000007B6000-memory.dmp

    Filesize

    24KB

  • memory/4308-136-0x00000000007E0000-0x00000000007E6000-memory.dmp

    Filesize

    24KB

  • memory/4308-153-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB

  • memory/4912-151-0x0000000000750000-0x0000000000756000-memory.dmp

    Filesize

    24KB

  • memory/4912-152-0x0000000000730000-0x0000000000736000-memory.dmp

    Filesize

    24KB

  • memory/4912-159-0x0000000000500000-0x0000000000510000-memory.dmp

    Filesize

    64KB