45f528be6201bf0a908edfd6653ea109328e94d1a9f5891a4a12c9064452828d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_a0daa3e66329dd0b71653381594e778e_cryptolocker.exe
Size

47KB
MD5

a0daa3e66329dd0b71653381594e778e
SHA1

7e6b343830665c9997fd970e15017dc85d0f91c4
SHA256

45f528be6201bf0a908edfd6653ea109328e94d1a9f5891a4a12c9064452828d
SHA512

1ed0f0cb36138551c8b10b633098d933a117a9cf8ec3199167a6662ff4a728e0c0aba7affd1f9aaf412c9b044c7f3256f94802dd42ebea04c974dc884fd4d208
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTm:X6QFElP6n+gJBMOtEvwDpjBtEh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2056	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
3020	2024-01-09_a0daa3e66329dd0b71653381594e778e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2056	3020	2024-01-09_a0daa3e66329dd0b71653381594e778e_cryptolocker.exe	28
PID 3020 wrote to memory of 2056	3020	2024-01-09_a0daa3e66329dd0b71653381594e778e_cryptolocker.exe	28
PID 3020 wrote to memory of 2056	3020	2024-01-09_a0daa3e66329dd0b71653381594e778e_cryptolocker.exe	28
PID 3020 wrote to memory of 2056	3020	2024-01-09_a0daa3e66329dd0b71653381594e778e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-09_a0daa3e66329dd0b71653381594e778e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_a0daa3e66329dd0b71653381594e778e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
5a19b7c9f87f2bf9c21d2a0beeb98755

SHA1
5d9f4dae5f96d145dce398a87b2c19fe4c5a32f5

SHA256
b818d1f8dbf93bf533c85d9bb77ab738a845c40e0cff96ec9e350f075a1449ec

SHA512
046da7b595f9f30a26fcd24a83d42ca5889963794524ffceaa11ee870d2485c7c117d19ec0c6b3b7c880e5f904c51efaeebe2ef9b4ae513ab2a035a81208e4c1

Download Submit
memory/2056-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2056-15-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/3020-0-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/3020-1-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/3020-7-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download