6bfdab4cb881cb9be15e484fa06bc1e984f9e5979418bbac8a8a3ddce1542658

Analysis

max time kernel
151s
max time network
169s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_b9992cf4f69b91af0bb8eb4ecb96d696_cryptolocker.exe
Size

48KB
MD5

b9992cf4f69b91af0bb8eb4ecb96d696
SHA1

86ae58a9cc6a646b5667075f42b8674efbc6ec52
SHA256

6bfdab4cb881cb9be15e484fa06bc1e984f9e5979418bbac8a8a3ddce1542658
SHA512

92d6f5649cb80cfedf1d2b49c347b12f2db1139ffd8b68ed420ff44323da3e1e17c99085f4e9375a4624d27c144d0d97358d330f6702833ea0310a05638ccdb3
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/BtOOtEvwDpjBVaD3E09vaTjE:X6QFElP6n+gJBMOtEvwDpjBtEz

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2116	2024-01-09_b9992cf4f69b91af0bb8eb4ecb96d696_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2116 wrote to memory of 2696	2116	2024-01-09_b9992cf4f69b91af0bb8eb4ecb96d696_cryptolocker.exe	28
PID 2116 wrote to memory of 2696	2116	2024-01-09_b9992cf4f69b91af0bb8eb4ecb96d696_cryptolocker.exe	28
PID 2116 wrote to memory of 2696	2116	2024-01-09_b9992cf4f69b91af0bb8eb4ecb96d696_cryptolocker.exe	28
PID 2116 wrote to memory of 2696	2116	2024-01-09_b9992cf4f69b91af0bb8eb4ecb96d696_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-09_b9992cf4f69b91af0bb8eb4ecb96d696_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_b9992cf4f69b91af0bb8eb4ecb96d696_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2116
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
48KB

MD5
0ff15471ac6d8225b33630de3c9ca984

SHA1
a7b1d7301c347d05e9122aee819e644e6082358e

SHA256
a310272d6ec9773916aac2b3f6d1a54b4f17536e210124fc3b1227089dbcd181

SHA512
047defb80dbec20d23fe9d2fa82f13968e2d77e69386674596f5477166044f7ef9f9829b447e6ed646b9723358deb4fd4a8f8bb89be852d2b39883ea6ff12950

Download Submit
memory/2116-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2116-2-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2116-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2696-15-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2696-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download