4a3e6e1d6e1967fac2a098e91574700f0f1b1bd63b6e446a16930cec1579fbfa

Analysis

max time kernel
0s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
09/01/2024, 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_9cc7a5488fd6b8757ccbefc29278ebf1_cryptolocker.exe
Size

43KB
MD5

9cc7a5488fd6b8757ccbefc29278ebf1
SHA1

00d2de6e57be4fc8df16b89b2a545771f7e634a9
SHA256

4a3e6e1d6e1967fac2a098e91574700f0f1b1bd63b6e446a16930cec1579fbfa
SHA512

b5140e554a3161cff8736ca37f15e46e8d9584d0e395e2794416c5e728459e0b7fa2d5cd85db4d95d6b8f355f7cee787ed590796ded3aabf78c514e3cec877a8
SSDEEP

768:79inqyNR/QtOOtEvwDpjBKccJVODvcjp9:79mqyNhQMOtEvwDpjBzckk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2264	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2248	2024-01-08_9cc7a5488fd6b8757ccbefc29278ebf1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 2264	2248	2024-01-08_9cc7a5488fd6b8757ccbefc29278ebf1_cryptolocker.exe	14
PID 2248 wrote to memory of 2264	2248	2024-01-08_9cc7a5488fd6b8757ccbefc29278ebf1_cryptolocker.exe	14
PID 2248 wrote to memory of 2264	2248	2024-01-08_9cc7a5488fd6b8757ccbefc29278ebf1_cryptolocker.exe	14
PID 2248 wrote to memory of 2264	2248	2024-01-08_9cc7a5488fd6b8757ccbefc29278ebf1_cryptolocker.exe	14

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
1⤵
- Executes dropped EXE
PID:2264

C:\Users\Admin\AppData\Local\Temp\2024-01-08_9cc7a5488fd6b8757ccbefc29278ebf1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_9cc7a5488fd6b8757ccbefc29278ebf1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2248

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
6KB

MD5
17a8228b3172c65bf9a164b0f7bd0128

SHA1
35351165f40ab53cce161ae23d4b6fa8662b42ac

SHA256
56e1c8cba8b4b09f8464fdfa0b68d996575f91aaa8c9a661a46fe01a1ee3ff15

SHA512
e6049b46f3f518d01719e9759cf3d3606936c9521bfb5fe2dc874823099d1936bf28fcefedfa8087294295ce270bee092442fabd1c26e3cc4cf8095f74a2174c

Download Submit
memory/2248-9-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2248-8-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2248-1-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2248-0-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2264-24-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2264-23-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2264-16-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download