645353a57b4b2795c92ac8c1a1625042ae7da961fc196c9df42203391ecc80d7

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_b0598d3245f0fe7127fa404f4db6eec1_cryptolocker.exe
Size

51KB
MD5

b0598d3245f0fe7127fa404f4db6eec1
SHA1

5bd73e7ba484eac029cf488272b40d6e308c29ed
SHA256

645353a57b4b2795c92ac8c1a1625042ae7da961fc196c9df42203391ecc80d7
SHA512

82576d4e7d496bc7a298fefc68c02933094fcb2b39e7545f518e566801ec0c12df2d80d2ee4e5df3abe2ef9bedf5432394c1574465a7eca955a01789e44ba8a0
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQ7suIlsw92KFXpQenhuTT:V6QFElP6n+gMQMOtEvwDpjeJQ7pojkR3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2420	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2008	2024-01-06_b0598d3245f0fe7127fa404f4db6eec1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2008 wrote to memory of 2420	2008	2024-01-06_b0598d3245f0fe7127fa404f4db6eec1_cryptolocker.exe	28
PID 2008 wrote to memory of 2420	2008	2024-01-06_b0598d3245f0fe7127fa404f4db6eec1_cryptolocker.exe	28
PID 2008 wrote to memory of 2420	2008	2024-01-06_b0598d3245f0fe7127fa404f4db6eec1_cryptolocker.exe	28
PID 2008 wrote to memory of 2420	2008	2024-01-06_b0598d3245f0fe7127fa404f4db6eec1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-06_b0598d3245f0fe7127fa404f4db6eec1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_b0598d3245f0fe7127fa404f4db6eec1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
51KB

MD5
befceacf8480f543e14227fbbd3f0f15

SHA1
2baaa7a6ea001494d697ddbc2c41e96d09de886e

SHA256
68ba878ccb0db6dece2095e9a33b18250de3100238811f6cb7937a12d944b30a

SHA512
8b571e3698254fc6c67e819f99912d26c8fc285793bee26e374881f8be76a567f39ffdf27427806c4f1143c71f2c352f0e906d57884436f32447cf237b4aef17

Download Submit
memory/2008-0-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2008-1-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2008-2-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2420-22-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2420-15-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download