df9080a18ea1e821595700a8efef21d30b55599d89c52848e50dd783d2c80da5

Analysis

max time kernel
1s
max time network
140s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/01/2024, 06:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-11_ca4e62de9a3774c7ed1bddc8f28a15fe_cryptolocker.exe
Size

58KB
MD5

ca4e62de9a3774c7ed1bddc8f28a15fe
SHA1

0f917ec1f94fbbdb13c477b91e969f7b328b1062
SHA256

df9080a18ea1e821595700a8efef21d30b55599d89c52848e50dd783d2c80da5
SHA512

42941d4c0c005d0de8c685a6a1e6b239f4889dac29f729fea3e9f71a3aa5a5e9d67e099538eb8c2bf690e10985c6d7626a1c6da43053391737b75e77184c5776
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLa5VccPt547/GfJ:V6QFElP6n+gMQMOtEvwDpjyaLccVCbmJ

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2764	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2496	2024-01-11_ca4e62de9a3774c7ed1bddc8f28a15fe_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 2764	2496	2024-01-11_ca4e62de9a3774c7ed1bddc8f28a15fe_cryptolocker.exe	16
PID 2496 wrote to memory of 2764	2496	2024-01-11_ca4e62de9a3774c7ed1bddc8f28a15fe_cryptolocker.exe	16
PID 2496 wrote to memory of 2764	2496	2024-01-11_ca4e62de9a3774c7ed1bddc8f28a15fe_cryptolocker.exe	16
PID 2496 wrote to memory of 2764	2496	2024-01-11_ca4e62de9a3774c7ed1bddc8f28a15fe_cryptolocker.exe	16

C:\Users\Admin\AppData\Local\Temp\2024-01-11_ca4e62de9a3774c7ed1bddc8f28a15fe_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-11_ca4e62de9a3774c7ed1bddc8f28a15fe_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
36KB

MD5
dca2f13eb3aa604882de0c90b02e72df

SHA1
cc2e0a0cbfaf84a4ae09e2389d8954c534fb7663

SHA256
9e7ed8a8016d27d7758a262b7705253e94053a6c89ab8e88fed375a68ffab758

SHA512
17238f9bfdf54bdb604fda085bf86f4a22604b361f521a6312061d08d54ae675b4aafcf3ecbab3f0006b6bdfca8dd7037651c74a5533d76a6480053fe7dd6da4

Download Submit
C:\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
58KB

MD5
5ac51e64dbfe9f886480afd814fec2ce

SHA1
e4d2031c7375422fad9cc742b53207fa2ed83133

SHA256
ce011850ebd2e7a5db4c17943b08839e772da6736c7912f93d2fdebdbc959cc6

SHA512
811cc32b9b2af678299f2a18771345255589bed61577480f2de02ee5f954626ab10deb196d5026ddfc7b3d39afea9a6898793c9695e66430cceb73e8fe91f18a

Download Submit
\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
27KB

MD5
4b69e53011a6a872970fa4225abde7fe

SHA1
2d9b03a991e91c557a274ffcf712d3377aa8dd74

SHA256
daeb94ce712dcaf7dc0091d78293f2a2ae045b5062aca6590865fd1ab97658a6

SHA512
5164b8a83b1d9755bb598dbb0e14f055aacb6675dd8f646b5cf4cd110bf7fdf3249077fb2fdfc337383ed26dbc60696529d2b1e2f7b79e8f85d988a09d853bda

Download Submit
memory/2496-3-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2496-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2496-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2764-15-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2764-19-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download