8454def36f82fa54465921b95d2f3bb07a45ee3ca5a8c5e73361bff6125dfff3

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
26-08-2023 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a47cb33020f86f7f5724e4fb78d3586d_cryptolocker_JC.exe
Size

45KB
MD5

a47cb33020f86f7f5724e4fb78d3586d
SHA1

03943550bd487ac5fa647ea8556c827561106664
SHA256

8454def36f82fa54465921b95d2f3bb07a45ee3ca5a8c5e73361bff6125dfff3
SHA512

511cd7aa661f3e44e90fb385c0c171693a16e993322c89391d2d54487a9c3b7c46248b78d1da9dc869cf7f97f5ec886c1dbd5994801931071aedb47aa83eaaca
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/W/rJ+xLrs7cwcx4MWfdp:79inqyNR/QtOOtEvwDpjBK/rJ+Nw84D

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2832	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
760	a47cb33020f86f7f5724e4fb78d3586d_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 760 wrote to memory of 2832	760	a47cb33020f86f7f5724e4fb78d3586d_cryptolocker_JC.exe	28
PID 760 wrote to memory of 2832	760	a47cb33020f86f7f5724e4fb78d3586d_cryptolocker_JC.exe	28
PID 760 wrote to memory of 2832	760	a47cb33020f86f7f5724e4fb78d3586d_cryptolocker_JC.exe	28
PID 760 wrote to memory of 2832	760	a47cb33020f86f7f5724e4fb78d3586d_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\a47cb33020f86f7f5724e4fb78d3586d_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\a47cb33020f86f7f5724e4fb78d3586d_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:760
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
032c6783f40f797f6df4dee1f250e0b6

SHA1
002dd436363ab3cd9933171702760f14b23eb767

SHA256
f71de3a6d70d17c3e15f9d131b6dfd6b297d53dfd7d8ac7e3ae434e3ad043bba

SHA512
75b9849f2ee3ab35ea25d9f57f5b143e123508902fc3105bf81515bd229f285266070e6abbf574b605e70f26636698c9788cbfc9ee2f980f0e8d42d73e064de7

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
032c6783f40f797f6df4dee1f250e0b6

SHA1
002dd436363ab3cd9933171702760f14b23eb767

SHA256
f71de3a6d70d17c3e15f9d131b6dfd6b297d53dfd7d8ac7e3ae434e3ad043bba

SHA512
75b9849f2ee3ab35ea25d9f57f5b143e123508902fc3105bf81515bd229f285266070e6abbf574b605e70f26636698c9788cbfc9ee2f980f0e8d42d73e064de7

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
46KB

MD5
032c6783f40f797f6df4dee1f250e0b6

SHA1
002dd436363ab3cd9933171702760f14b23eb767

SHA256
f71de3a6d70d17c3e15f9d131b6dfd6b297d53dfd7d8ac7e3ae434e3ad043bba

SHA512
75b9849f2ee3ab35ea25d9f57f5b143e123508902fc3105bf81515bd229f285266070e6abbf574b605e70f26636698c9788cbfc9ee2f980f0e8d42d73e064de7

Download Submit
memory/760-14-0x00000000008C0000-0x00000000008CF000-memory.dmp

Filesize
60KB

Download
memory/760-4-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/760-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/760-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/760-2-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/760-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/760-27-0x00000000008C0000-0x00000000008CF000-memory.dmp

Filesize
60KB

Download
memory/2832-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2832-19-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/2832-20-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2832-28-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download