ebf399c7e31401acec138e18c9e021703415e2baad52c12449f8e6c47aec6119

Analysis

max time kernel
134s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2023, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6a80716faa01fedc713f9cca4d344f34_cryptolocker_JC.exe
Size

58KB
MD5

6a80716faa01fedc713f9cca4d344f34
SHA1

c56229ef5ba293305d77523d4939025e99d08691
SHA256

ebf399c7e31401acec138e18c9e021703415e2baad52c12449f8e6c47aec6119
SHA512

4d0cf655a84c49968477156a51851ca221089dc9a1f768e181c7f2916f6918f05de6e4899d83bd41afc08796cfd7da93da844afcfd6fe8cf2bec304805750362
SSDEEP

1536:P8mnK6QFElP6n+gymddpMOtEvwDpjYX6E:1nK6a+qdOOtEvwDpjc

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1600	asih.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/8-133-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/files/0x00080000000230a4-146.dat	upx
behavioral2/files/0x00080000000230a4-148.dat	upx
behavioral2/files/0x00080000000230a4-149.dat	upx
behavioral2/memory/8-154-0x0000000000500000-0x000000000050F311-memory.dmp	upx
behavioral2/memory/1600-159-0x0000000000500000-0x000000000050F311-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 1600	8	6a80716faa01fedc713f9cca4d344f34_cryptolocker_JC.exe	81
PID 8 wrote to memory of 1600	8	6a80716faa01fedc713f9cca4d344f34_cryptolocker_JC.exe	81
PID 8 wrote to memory of 1600	8	6a80716faa01fedc713f9cca4d344f34_cryptolocker_JC.exe	81

C:\Users\Admin\AppData\Local\Temp\6a80716faa01fedc713f9cca4d344f34_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\6a80716faa01fedc713f9cca4d344f34_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
2cf2d8f43b93ee0db425c42a2035c713

SHA1
bbb5a08231cccbe4f9f19c2a03d68ff7bdf05145

SHA256
662d25d25ddbbeca54b1b5e89f405f2d7e32c292b1f266495d7d6b50523626ad

SHA512
852176af4733e45a75a7c361e40b4fb1644e9817200951ba1d1a1213eaa77ae955f7cc2c4d90eb4949e068c285105285b088362ff1284bbe6cfab8557481d3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
2cf2d8f43b93ee0db425c42a2035c713

SHA1
bbb5a08231cccbe4f9f19c2a03d68ff7bdf05145

SHA256
662d25d25ddbbeca54b1b5e89f405f2d7e32c292b1f266495d7d6b50523626ad

SHA512
852176af4733e45a75a7c361e40b4fb1644e9817200951ba1d1a1213eaa77ae955f7cc2c4d90eb4949e068c285105285b088362ff1284bbe6cfab8557481d3f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
2cf2d8f43b93ee0db425c42a2035c713

SHA1
bbb5a08231cccbe4f9f19c2a03d68ff7bdf05145

SHA256
662d25d25ddbbeca54b1b5e89f405f2d7e32c292b1f266495d7d6b50523626ad

SHA512
852176af4733e45a75a7c361e40b4fb1644e9817200951ba1d1a1213eaa77ae955f7cc2c4d90eb4949e068c285105285b088362ff1284bbe6cfab8557481d3f2

Download Submit
memory/8-133-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/8-134-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/8-135-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/8-136-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/8-154-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download
memory/1600-152-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/1600-151-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download
memory/1600-159-0x0000000000500000-0x000000000050F311-memory.dmp

Filesize
60KB

Download