3e3ebfa913f928bae402b3f3cd90a63af5038bba76580d07b936b8bcd7349bd7

Analysis

max time kernel
188s
max time network
216s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_149eac0fa5e1c97215f7ab19ebd2a5ad_cryptolocker.exe
Size

37KB
MD5

149eac0fa5e1c97215f7ab19ebd2a5ad
SHA1

5eda0e91a7da3f3e36f750d10e92993ae7973ef2
SHA256

3e3ebfa913f928bae402b3f3cd90a63af5038bba76580d07b936b8bcd7349bd7
SHA512

aedc42ca445ef336b50644a8efeab645c4797cb0673ef1677766a631608ea030538774386f7c4c40dab050a318fba06ab648ba037332def3db144323124be415
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpjeJQLI3Jnoehy5s:V6QFElP6n+gMQMOtEvwDpjeJQy1hye

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2768	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2620	2024-01-09_149eac0fa5e1c97215f7ab19ebd2a5ad_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 2768	2620	2024-01-09_149eac0fa5e1c97215f7ab19ebd2a5ad_cryptolocker.exe	29
PID 2620 wrote to memory of 2768	2620	2024-01-09_149eac0fa5e1c97215f7ab19ebd2a5ad_cryptolocker.exe	29
PID 2620 wrote to memory of 2768	2620	2024-01-09_149eac0fa5e1c97215f7ab19ebd2a5ad_cryptolocker.exe	29
PID 2620 wrote to memory of 2768	2620	2024-01-09_149eac0fa5e1c97215f7ab19ebd2a5ad_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-01-09_149eac0fa5e1c97215f7ab19ebd2a5ad_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_149eac0fa5e1c97215f7ab19ebd2a5ad_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
38KB

MD5
84e4fede237d4e94c682573c6ddc93f0

SHA1
06dc45a7dffaa985728744daaf39b0efcaeb7be2

SHA256
d08903685d2a0f16e0f38fdb854a6d2c57d705e08c876d04775e119c18ab7861

SHA512
c373d52bc34e275ebb54e52183be1fae13a51f1775efe6eaddc0d3d998b0858b47b0ed667b52fc8b6b4d76d16be48c8b7123c42f9ff6da2ac0b64f37671600f0

Download Submit
memory/2620-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2620-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2620-7-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2768-15-0x0000000000200000-0x0000000000206000-memory.dmp

Filesize
24KB

Download
memory/2768-17-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download