9246a0e12cc9882f0e628d673d5523c5c7fc47e2ae768864e3092a5c75485471

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
06/11/2023, 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-25_866f789f15e470a3a1a7d030bceff9e5_cryptolocker.exe
Size

31KB
MD5

866f789f15e470a3a1a7d030bceff9e5
SHA1

6dd0015cc3bfbb42ae3ecf5ef80d9a6cce5c4cd2
SHA256

9246a0e12cc9882f0e628d673d5523c5c7fc47e2ae768864e3092a5c75485471
SHA512

d8d43f09493d99732bea92767244fabaf11621e533943ca921c393f0ea9c4e7cdc6c42079b9ea36614d4e05bf089870bab47cabb8f48ff9cebbb598c2215fe9c
SSDEEP

768:qmOKYQDf5XdrDmjr5tOOtEvwDpjAajFEitQbDmok2:qmbhXDmjr5MOtEvwDpj5cDR

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1568	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2176	NEAS.2023-09-25_866f789f15e470a3a1a7d030bceff9e5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 1568	2176	NEAS.2023-09-25_866f789f15e470a3a1a7d030bceff9e5_cryptolocker.exe	28
PID 2176 wrote to memory of 1568	2176	NEAS.2023-09-25_866f789f15e470a3a1a7d030bceff9e5_cryptolocker.exe	28
PID 2176 wrote to memory of 1568	2176	NEAS.2023-09-25_866f789f15e470a3a1a7d030bceff9e5_cryptolocker.exe	28
PID 2176 wrote to memory of 1568	2176	NEAS.2023-09-25_866f789f15e470a3a1a7d030bceff9e5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-25_866f789f15e470a3a1a7d030bceff9e5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-25_866f789f15e470a3a1a7d030bceff9e5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
cfd5431a63c3135aab7629463dfde1d8

SHA1
7fa31840346c8e510118cec766eb9a332db841e6

SHA256
57b6d6ed5bca44625f6dcc94f9d5779d34f46f6a5b032f229484437dd3fa61b3

SHA512
b97f8fe814ffd897c40b5925989f2adeeafa7c43aa62248ad7e36cefb0f20e0b581a6d7683a6183653b0cbf245db49bf7498b647a958deea2f683d47f883d3f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
cfd5431a63c3135aab7629463dfde1d8

SHA1
7fa31840346c8e510118cec766eb9a332db841e6

SHA256
57b6d6ed5bca44625f6dcc94f9d5779d34f46f6a5b032f229484437dd3fa61b3

SHA512
b97f8fe814ffd897c40b5925989f2adeeafa7c43aa62248ad7e36cefb0f20e0b581a6d7683a6183653b0cbf245db49bf7498b647a958deea2f683d47f883d3f3

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
31KB

MD5
cfd5431a63c3135aab7629463dfde1d8

SHA1
7fa31840346c8e510118cec766eb9a332db841e6

SHA256
57b6d6ed5bca44625f6dcc94f9d5779d34f46f6a5b032f229484437dd3fa61b3

SHA512
b97f8fe814ffd897c40b5925989f2adeeafa7c43aa62248ad7e36cefb0f20e0b581a6d7683a6183653b0cbf245db49bf7498b647a958deea2f683d47f883d3f3

Download Submit
memory/1568-19-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download
memory/1568-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1568-20-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1568-28-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2176-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2176-14-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2176-3-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2176-16-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download
memory/2176-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2176-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2176-27-0x00000000005D0000-0x00000000005E0000-memory.dmp

Filesize
64KB

Download