4b017d35044178852f8a71a6edc6b7a3fba7ddab814ea1ff27464ad1ef2e4c9b

Analysis

max time kernel
0s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10-01-2024 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_c8c078892035b74c0bb1d92705334034_cryptolocker.exe
Size

42KB
MD5

c8c078892035b74c0bb1d92705334034
SHA1

52709b522d6c533ab118ea5367510529ff44bd80
SHA256

4b017d35044178852f8a71a6edc6b7a3fba7ddab814ea1ff27464ad1ef2e4c9b
SHA512

f1d7efc974d55dcc11192a9394036687490d9c83516c1566742b52a505ecd85fdcf308535b437e18444d99f288cb00c7c32b063f5582dd5b55829abb7d2b9377
SSDEEP

768:wHGGaSawqnwjRQ6ESlmFOsPoOdQtOOtEvwDpjm6j4AYsqSh+DETkedm+YUta:YGzl5wjRQBBOsP1QMOtEvwDpjl39+D+K

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2228	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1320	2024-01-09_c8c078892035b74c0bb1d92705334034_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2228	1320	2024-01-09_c8c078892035b74c0bb1d92705334034_cryptolocker.exe	14
PID 1320 wrote to memory of 2228	1320	2024-01-09_c8c078892035b74c0bb1d92705334034_cryptolocker.exe	14
PID 1320 wrote to memory of 2228	1320	2024-01-09_c8c078892035b74c0bb1d92705334034_cryptolocker.exe	14
PID 1320 wrote to memory of 2228	1320	2024-01-09_c8c078892035b74c0bb1d92705334034_cryptolocker.exe	14

C:\Users\Admin\AppData\Local\Temp\asih.exe
"C:\Users\Admin\AppData\Local\Temp\asih.exe"
1⤵
- Executes dropped EXE
PID:2228

C:\Users\Admin\AppData\Local\Temp\2024-01-09_c8c078892035b74c0bb1d92705334034_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_c8c078892035b74c0bb1d92705334034_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
37KB

MD5
cf7856bb99f2d8e1ade6674804aab123

SHA1
98cc6c8fe89f44f24d949ca351bc78b080d6092c

SHA256
de4688319df3e40aac609fecc9450dc45c9d86cbf08372abfa2ecccb0527d808

SHA512
f90a88e95d1f31825ce2264e9a84d09effe61bb979ae8c2440e6e8c9753be4659994d09f61d75c53e1668273cf5c66b1c4e15160794bd0b88db0adc4c36d8207

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
35KB

MD5
abb861812811c62136b3dc0ea450457f

SHA1
f72b3ab79d1f4214313853b8ae2ac3604c6e4a38

SHA256
7a09fbd498823b4e70e8970acde3c54af9c50a19233bfcbcbed6a5ce99b9c388

SHA512
0539fa5e6db867333fcb332945fe1767e678963f823b2537e832aa22b64d92b4d7fef2c113aa6388c816ebcff83e6433f22e1df6112b4e3f195c578305d08f51

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
28KB

MD5
a0b077f4bd5118f2aaa1c4576de1dd56

SHA1
ba43d0c6178a9a6117cd9f03ace8feea0ac085cd

SHA256
710b31f6f8665a0de061c5ab776b0439367dca30a65cfa81ce7280786cc24aac

SHA512
441c9f0037b8eff546ad3c500cd4db6d9f5e521708074bace1e5d03ffdb950b0ddfcc80ec1d8b8e70604fcd6a06e301aa2dd55e302d86f665c1d875841a627ce

Download Submit
memory/1320-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1320-8-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/1320-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1320-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2228-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2228-17-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download