ae185cf618f1e9b09faa82f716f646c469f356752ea40af58baa15ca10c6ead6

Analysis

max time kernel
1s
max time network
164s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe
Size

41KB
MD5

a8ff2cede9752436e03ede89c806bddb
SHA1

2e8d6eea07c1cef7ea8cc0c9c293b8c2d5bd92d5
SHA256

ae185cf618f1e9b09faa82f716f646c469f356752ea40af58baa15ca10c6ead6
SHA512

c9f34b31416fce5b46e508f9c53b4aeba0140b78b03aac5eb4f5ecc1a8b96db32c48fce550aa0e17c85173151e8507229a72e657d038358e5165b613554452db
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCMB:79inqyNR/QtOOtEvwDpjBKccJVODvym

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1020	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2236	2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1020	2236	2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe	16
PID 2236 wrote to memory of 1020	2236	2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe	16
PID 2236 wrote to memory of 1020	2236	2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe	16
PID 2236 wrote to memory of 1020	2236	2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
1⤵
- Executes dropped EXE
PID:1020

C:\Users\Admin\AppData\Local\Temp\2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_a8ff2cede9752436e03ede89c806bddb_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
14KB

MD5
ed7e9b200cf7c0fda977fc686ce0f5f4

SHA1
fbb2ca15d179c0af0f7a79559cf0fa8150ebfc31

SHA256
c617601ec538aa256ffec9bba5271f05e1e0845b2edcfd9c393d29960a2f9e16

SHA512
55a5a193ee5aa396dc88370edd71d1e85b824d8a984e69a87a0e09f82f27c00b2d75dd0058556724e2818c71f0ba670dceee14d2a16844c617180767476debbd

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
41KB

MD5
6a99ae9f353f9dc62f809ee6abb5d07e

SHA1
29b056ba48a1868fd8dda5938c0c97789c2f308f

SHA256
5de3cb5a2b171bb8c8c5d0b6351a183e65c769b51f46087e7e744b8f088a1001

SHA512
ba409a6a7d936f46d9c7bbc5b03a19568842bb36cfdcbb6c258e8c717b6bbb67afec7068dd432ccb7801d2f417635e6ce71db94a40ffff46958991c0ceb550d3

Download Submit
memory/1020-19-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1020-26-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1020-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2236-1-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2236-2-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2236-8-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2236-0-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2236-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2236-14-0x0000000002700000-0x000000000270F000-memory.dmp

Filesize
60KB

Download