39a8662d4938b6b65cc42d37ff71c0873a830afb0ab738dbaeda414cc88e6759

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 06:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-09_f190caf7f1805d980ba11dc5f1b32d56_cryptolocker.exe
Size

49KB
MD5

f190caf7f1805d980ba11dc5f1b32d56
SHA1

a483449a0212160b54d1b3b4afbbc5122b1e7f7c
SHA256

39a8662d4938b6b65cc42d37ff71c0873a830afb0ab738dbaeda414cc88e6759
SHA512

ed2325170040e408adae8cd55ebb158c2098bdc124b8f171a5d01e018c2634c3bedd1419b68dabd983d7b84dfa7dca4a1ad6f60296a9ab41e8ddec8dcd6af93b
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb6Imp9yO:BbdDmjr+OtEvwDpjMN

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1936	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2888	2024-01-09_f190caf7f1805d980ba11dc5f1b32d56_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1936	2888	2024-01-09_f190caf7f1805d980ba11dc5f1b32d56_cryptolocker.exe	14
PID 2888 wrote to memory of 1936	2888	2024-01-09_f190caf7f1805d980ba11dc5f1b32d56_cryptolocker.exe	14
PID 2888 wrote to memory of 1936	2888	2024-01-09_f190caf7f1805d980ba11dc5f1b32d56_cryptolocker.exe	14
PID 2888 wrote to memory of 1936	2888	2024-01-09_f190caf7f1805d980ba11dc5f1b32d56_cryptolocker.exe	14

C:\Users\Admin\AppData\Local\Temp\2024-01-09_f190caf7f1805d980ba11dc5f1b32d56_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-09_f190caf7f1805d980ba11dc5f1b32d56_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
50KB

MD5
fbd3465e845bf9b85cf663efd9cae838

SHA1
6096d583f630570f9be76aef34bcaa1af90f918f

SHA256
3deb69bba7f7ebcf4b6df3e842874aaa01ae19ca9df511128c16842488975377

SHA512
3ed0697fb5a1750e3df65aa175db261b99940d55511e663371d206215c8a024ed32c3f2e9e865d81fde1a52f3bb8cbd934dd0537ec9c6965ce16f655cefa1a80

Download Submit
memory/1936-18-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/1936-20-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1936-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1936-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2888-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2888-1-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2888-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2888-15-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/2888-2-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download