ac1f5319b93c9c4b267a7febd7d10296277167af2fdc03b30dd44503983ab8a7

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2023, 17:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7c3b932b5a427387de05f791e8fe1daa_cryptolocker_JC.exe
Size

48KB
MD5

7c3b932b5a427387de05f791e8fe1daa
SHA1

409dbd08a8c4047b01272181c111eac8fa1fe6e2
SHA256

ac1f5319b93c9c4b267a7febd7d10296277167af2fdc03b30dd44503983ab8a7
SHA512

8dd1ef68886a569732575b5d9b861a5ce5a370eb6004c01d08d18b17758cf5da92cbfc709115e25a028289c2b4f35a96e873b1e77209eea245a70ca50b1aecf8
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6Lv/:BbdDmjr+OtEvwDpjMf

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
320	asih.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 320	3040	7c3b932b5a427387de05f791e8fe1daa_cryptolocker_JC.exe	83
PID 3040 wrote to memory of 320	3040	7c3b932b5a427387de05f791e8fe1daa_cryptolocker_JC.exe	83
PID 3040 wrote to memory of 320	3040	7c3b932b5a427387de05f791e8fe1daa_cryptolocker_JC.exe	83

C:\Users\Admin\AppData\Local\Temp\7c3b932b5a427387de05f791e8fe1daa_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\7c3b932b5a427387de05f791e8fe1daa_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
9b42afa310467f5cc8ed92921dd684c9

SHA1
ed362e2b08487287a3046212d04f793caae34464

SHA256
4f39f74c60e9e80c10e1f12fcab6f6d9100da73d0a6f14c411dc525f02567654

SHA512
e4794e87f6290c5ceb3674423474fa7f181262a3f971e750f3d6dcc4b217b788c8219fadc9b5f5c366dcb73d363ed6e0b36d162db7718360ee3cc996cfd1d826

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
9b42afa310467f5cc8ed92921dd684c9

SHA1
ed362e2b08487287a3046212d04f793caae34464

SHA256
4f39f74c60e9e80c10e1f12fcab6f6d9100da73d0a6f14c411dc525f02567654

SHA512
e4794e87f6290c5ceb3674423474fa7f181262a3f971e750f3d6dcc4b217b788c8219fadc9b5f5c366dcb73d363ed6e0b36d162db7718360ee3cc996cfd1d826

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
9b42afa310467f5cc8ed92921dd684c9

SHA1
ed362e2b08487287a3046212d04f793caae34464

SHA256
4f39f74c60e9e80c10e1f12fcab6f6d9100da73d0a6f14c411dc525f02567654

SHA512
e4794e87f6290c5ceb3674423474fa7f181262a3f971e750f3d6dcc4b217b788c8219fadc9b5f5c366dcb73d363ed6e0b36d162db7718360ee3cc996cfd1d826

Download Submit
memory/320-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/320-19-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/320-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3040-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3040-1-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/3040-2-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/3040-3-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/3040-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download