bcca5bdfcd6d80e0c861e1eb5880ca940a9744f27d51bb92942f692d90b5efff

Analysis

max time kernel
0s
max time network
137s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
09-01-2024 06:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_9ef372e2ee027e8a41c92bdcba3d2ba6_cryptolocker.exe
Size

57KB
MD5

9ef372e2ee027e8a41c92bdcba3d2ba6
SHA1

505b6153c0580dae26fc547ac1b3f9767d441108
SHA256

bcca5bdfcd6d80e0c861e1eb5880ca940a9744f27d51bb92942f692d90b5efff
SHA512

e0b053f283c661a0babdfd417381fe6cc74dc640c5aa2c2a9412d626b14c00a8ca9bf3998704ba390a1acfce42297064d27a74e6fb8902b67db167d556fd5081
SSDEEP

1536:X6QFElP6n+gJQMOtEvwDpjBccD2RuoNmuBLZ/5:X6a+SOtEvwDpjBrOx

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2192	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2628	2024-01-08_9ef372e2ee027e8a41c92bdcba3d2ba6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 2192	2628	2024-01-08_9ef372e2ee027e8a41c92bdcba3d2ba6_cryptolocker.exe	16
PID 2628 wrote to memory of 2192	2628	2024-01-08_9ef372e2ee027e8a41c92bdcba3d2ba6_cryptolocker.exe	16
PID 2628 wrote to memory of 2192	2628	2024-01-08_9ef372e2ee027e8a41c92bdcba3d2ba6_cryptolocker.exe	16
PID 2628 wrote to memory of 2192	2628	2024-01-08_9ef372e2ee027e8a41c92bdcba3d2ba6_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-08_9ef372e2ee027e8a41c92bdcba3d2ba6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_9ef372e2ee027e8a41c92bdcba3d2ba6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
26KB

MD5
90fee2fefeb828c949a72f6ea7398122

SHA1
a8054e34e76195d55bf76faf80cc6f6f56c16f38

SHA256
697dd0d76c2a49d21a5988ed09f070a58c3b5d960fbc8e0aad3350625d99a873

SHA512
b52cc5a13d4ffa0f3d87673621d6b7a81a5c42c76f662be396dc712dfc148a952e2c7ba882041668282c48eda1d62d156938902219fc6854e5f11c9b337bbf12

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
9KB

MD5
fdccc1fddbd5fe5ff3734cb51ce299ec

SHA1
0cf28bcd3a3abce8d05403cbc4e4b6ae11c75e49

SHA256
7bff4e04c9165ac957560f98b355e129d69649cd75bc1a3a1b3239001c98c2d8

SHA512
2a33e2bc39b5faad5a84f8ee065b779a6b8cbaeaeac331b6a4e7db71488619646697344bf225f5b02340014ad1ea0ac79901d124195f4e1bfa033fd5a36d09be

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
5KB

MD5
019727a3d1b124bb0300c5126ff5b33b

SHA1
dcfb398e808d8b907ba89a5aaccbfa6c500c15e4

SHA256
f185e7faafe2d67c668e7110a8f7ad343cc0ff6c347f04b2ee7288dd12d8831a

SHA512
f88d22d5971242d85f74fd3e99eda1018a1cb317171de0402902e810bb5ef5e0b7e4ec36a631dd1ba761fe566a75ee91779261417c66a05e115c790a32bd0f45

Download Submit
memory/2192-15-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2192-22-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2628-3-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2628-1-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2628-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download