4383eaf1c7ab14d0f62f112be3456ffe961e7972c57c4c1b1af4a348400efa30

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
21/08/2023, 17:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61aa2ae037d1c951f8ddfd335c3ffe74_cryptolocker_JC.exe
Size

139KB
MD5

61aa2ae037d1c951f8ddfd335c3ffe74
SHA1

4fb59e78aded66a7ae027bbd6212ce56b611c243
SHA256

4383eaf1c7ab14d0f62f112be3456ffe961e7972c57c4c1b1af4a348400efa30
SHA512

d43534806edb4a5b4b10f5c4a282a4928596d71ed1b9e37cba1d8bfdb637d6074379a3fc4a02f107346f44b6615e0ec0d17749ca5067e91e8905161a771cd3a1
SSDEEP

1536:z6QFElP6n+gKmddpMOtEvwDpj3GYQbN/PKwNgp699GX2fF:z6a+CdOOtEvwDpjczJ

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1060	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	61aa2ae037d1c951f8ddfd335c3ffe74_cryptolocker_JC.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2180-54-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/2180-68-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/memory/1060-70-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral1/files/0x0008000000012028-69.dat	upx
behavioral1/files/0x0008000000012028-65.dat	upx
behavioral1/files/0x0008000000012028-79.dat	upx
behavioral1/memory/1060-80-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 1060	2180	61aa2ae037d1c951f8ddfd335c3ffe74_cryptolocker_JC.exe	28
PID 2180 wrote to memory of 1060	2180	61aa2ae037d1c951f8ddfd335c3ffe74_cryptolocker_JC.exe	28
PID 2180 wrote to memory of 1060	2180	61aa2ae037d1c951f8ddfd335c3ffe74_cryptolocker_JC.exe	28
PID 2180 wrote to memory of 1060	2180	61aa2ae037d1c951f8ddfd335c3ffe74_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\61aa2ae037d1c951f8ddfd335c3ffe74_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\61aa2ae037d1c951f8ddfd335c3ffe74_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1060

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
139KB

MD5
a8a14a3049cef6492762c0b30732cc0c

SHA1
44dbd6dc71d7d440503a597c1e9870c778a0d1f3

SHA256
2d93076300f140c3ef8b444a636df900842fbbbdd30ca7d6fd1e18ab430d14c8

SHA512
df76b97e85375f012a6a7d27be38a85caf1e8825c29fad491d4d2f31ec124d4836d7d2d543a0c72c2f42b97097f2522fac9fa1a2e97beb9eb152eab1643448fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
139KB

MD5
a8a14a3049cef6492762c0b30732cc0c

SHA1
44dbd6dc71d7d440503a597c1e9870c778a0d1f3

SHA256
2d93076300f140c3ef8b444a636df900842fbbbdd30ca7d6fd1e18ab430d14c8

SHA512
df76b97e85375f012a6a7d27be38a85caf1e8825c29fad491d4d2f31ec124d4836d7d2d543a0c72c2f42b97097f2522fac9fa1a2e97beb9eb152eab1643448fb

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
139KB

MD5
a8a14a3049cef6492762c0b30732cc0c

SHA1
44dbd6dc71d7d440503a597c1e9870c778a0d1f3

SHA256
2d93076300f140c3ef8b444a636df900842fbbbdd30ca7d6fd1e18ab430d14c8

SHA512
df76b97e85375f012a6a7d27be38a85caf1e8825c29fad491d4d2f31ec124d4836d7d2d543a0c72c2f42b97097f2522fac9fa1a2e97beb9eb152eab1643448fb

Download Submit
memory/1060-70-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1060-72-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/1060-73-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/1060-80-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2180-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2180-55-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2180-56-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2180-57-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2180-68-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download