64191b0e6e2f2f51278de09ec9f5a9fff7b749fdab675877e4df3794f1b0c6d2

Analysis

max time kernel
135s
max time network
145s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
19-08-2023 12:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3e4e27a0f395f0c6c52d7671a0e927bd_cryptolocker_JC.exe
Size

97KB
MD5

3e4e27a0f395f0c6c52d7671a0e927bd
SHA1

2d9655bcb2e443ac448728fe3f52f57b360e9994
SHA256

64191b0e6e2f2f51278de09ec9f5a9fff7b749fdab675877e4df3794f1b0c6d2
SHA512

72c17fc993571ba41a21ca985dd335c1fd78a310812abd0bd4cde4ecfdd4cc9850ece150cd04b116df3b03d21fff968c503b6583e0fe547bd4c71cd53924f98c
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgb9:V6a+pOtEvwDpjtzU

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2264	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2064	3e4e27a0f395f0c6c52d7671a0e927bd_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 2264	2064	3e4e27a0f395f0c6c52d7671a0e927bd_cryptolocker_JC.exe	29
PID 2064 wrote to memory of 2264	2064	3e4e27a0f395f0c6c52d7671a0e927bd_cryptolocker_JC.exe	29
PID 2064 wrote to memory of 2264	2064	3e4e27a0f395f0c6c52d7671a0e927bd_cryptolocker_JC.exe	29
PID 2064 wrote to memory of 2264	2064	3e4e27a0f395f0c6c52d7671a0e927bd_cryptolocker_JC.exe	29

C:\Users\Admin\AppData\Local\Temp\3e4e27a0f395f0c6c52d7671a0e927bd_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\3e4e27a0f395f0c6c52d7671a0e927bd_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
97KB

MD5
2dd51999e41bdeec0bd5fed0985702ad

SHA1
5e04583ebaeeb19976455d5a5f94dba50b4db5a2

SHA256
75859a60414d1a2f6adb4b94316396140b0b4da4d5338d4aea76a4afd3ff066f

SHA512
cf581a2665b3b2b7b7d36e66aa73d44b1e45c7020da4795633864d882489e6b8c31abda38f3accac50be672c23f27c18c656bf61b850f4739e3021e1a9833cda

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
97KB

MD5
2dd51999e41bdeec0bd5fed0985702ad

SHA1
5e04583ebaeeb19976455d5a5f94dba50b4db5a2

SHA256
75859a60414d1a2f6adb4b94316396140b0b4da4d5338d4aea76a4afd3ff066f

SHA512
cf581a2665b3b2b7b7d36e66aa73d44b1e45c7020da4795633864d882489e6b8c31abda38f3accac50be672c23f27c18c656bf61b850f4739e3021e1a9833cda

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
97KB

MD5
2dd51999e41bdeec0bd5fed0985702ad

SHA1
5e04583ebaeeb19976455d5a5f94dba50b4db5a2

SHA256
75859a60414d1a2f6adb4b94316396140b0b4da4d5338d4aea76a4afd3ff066f

SHA512
cf581a2665b3b2b7b7d36e66aa73d44b1e45c7020da4795633864d882489e6b8c31abda38f3accac50be672c23f27c18c656bf61b850f4739e3021e1a9833cda

Download Submit
memory/2064-54-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2064-56-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2064-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2264-69-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download