ca1c26700bf74745059320191da89c61d9952df2dcd15ef193fbb8fb5b620cb3

Analysis

max time kernel
132s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_5976209537e2ec21c57b42e27b600bd5_cryptolocker.exe
Size

44KB
MD5

5976209537e2ec21c57b42e27b600bd5
SHA1

eb081fef3aa5e94bf55bebe176d170106b4dbc43
SHA256

ca1c26700bf74745059320191da89c61d9952df2dcd15ef193fbb8fb5b620cb3
SHA512

dcc35c7dd5e053c839be87a804060e8177ad72c5703d6d9a0cc322db409fca4ae8f2506d75e46879cb6b9fe19e033598261be416ec0efa9f0e637b02819ecf14
SSDEEP

768:X6LsoEEeegiZPvEhHSG+gp/QtOOtEvwDpjBaaEqbIu556NPQ:X6QFElP6n+gJQMOtEvwDpjB0GIWMPQ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3048	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1360	2024-01-11_5976209537e2ec21c57b42e27b600bd5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1360 wrote to memory of 3048	1360	2024-01-11_5976209537e2ec21c57b42e27b600bd5_cryptolocker.exe	28
PID 1360 wrote to memory of 3048	1360	2024-01-11_5976209537e2ec21c57b42e27b600bd5_cryptolocker.exe	28
PID 1360 wrote to memory of 3048	1360	2024-01-11_5976209537e2ec21c57b42e27b600bd5_cryptolocker.exe	28
PID 1360 wrote to memory of 3048	1360	2024-01-11_5976209537e2ec21c57b42e27b600bd5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-11_5976209537e2ec21c57b42e27b600bd5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_5976209537e2ec21c57b42e27b600bd5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1360
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
44KB

MD5
91f8b3611711fb016410cd76a1a80fd4

SHA1
f54ea188288a3df8a7845110ab02dc6aaefb71ca

SHA256
612c67c722024cfaab8da0829647bb67df92a1e6d00d3e0fb57d91457cc04b89

SHA512
8d4b4050e2e2eb3c2221ff7feba6d708d7794eb1a75f97f95d06131f2ea2797a8245bf308711dcbe6c8ec8002ddd3b7618d4d7a61ce9d411e6359d1fdf389942

Download Submit
memory/1360-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1360-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1360-1-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download