56951b71ee7700affcdb5b59d3a0c5b1fc9ca9542d4f094dbc14def52d7fc585

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 05:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_5d71437166ce82fe43b8c671f0b0c382_cryptolocker.exe
Size

93KB
MD5

5d71437166ce82fe43b8c671f0b0c382
SHA1

5f876e4872c649d3e3b51126e38106961fdbeec2
SHA256

56951b71ee7700affcdb5b59d3a0c5b1fc9ca9542d4f094dbc14def52d7fc585
SHA512

02713bb4bc1d7813bf0cde04719de84aa40baeefc0a7c595fe10a50c65bdc200567f9a1d26ba1089f778b88c922ee7e927c42d418fa51e6c65212eebaef82c6b
SSDEEP

1536:26QFElP6n+gBQMOtEvwDpjQGYQbN/PKwNCN:26a+2OtEvwDpjtza

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2040	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2928	2024-01-11_5d71437166ce82fe43b8c671f0b0c382_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 2040	2928	2024-01-11_5d71437166ce82fe43b8c671f0b0c382_cryptolocker.exe	28
PID 2928 wrote to memory of 2040	2928	2024-01-11_5d71437166ce82fe43b8c671f0b0c382_cryptolocker.exe	28
PID 2928 wrote to memory of 2040	2928	2024-01-11_5d71437166ce82fe43b8c671f0b0c382_cryptolocker.exe	28
PID 2928 wrote to memory of 2040	2928	2024-01-11_5d71437166ce82fe43b8c671f0b0c382_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-11_5d71437166ce82fe43b8c671f0b0c382_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_5d71437166ce82fe43b8c671f0b0c382_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
93KB

MD5
a3351e4f93a81c7062d94df9d7686872

SHA1
06a79b48ef8b6556b3a1c971243d1e76ec0d2e35

SHA256
46d204c94f8a4f1951737b2a341c4b3f6671265164da86c08f85d844c4ce62a4

SHA512
9d3e2102ed9bd469f996b3516241b2faf9db554dd6fa5ac3049d7bf318edbf5e90cf2ce0db0311d909745cb577b352b6ab44325d28a10568dbd1f6a9671a6f68

Download Submit
memory/2040-15-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2040-17-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/2928-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2928-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2928-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download