2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 20:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4.exe
Size

46KB
MD5

2e60aa4d0f4bb11997683ebc784b6584
SHA1

4325e8f186fdb1a40c485c8d953f6eefbcf2681f
SHA256

2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4
SHA512

872c15bea40f6b964329959d2886b177698ac9da6443a9d3b964c05ecbb07580b3a704a34086c90395bdd76079799d00f8de8a779cbcd641c4b25f91370beff5
SSDEEP

768:V6LsoEEeegiZPvEhHSG+gDYQtOOtEvwDpj/MLam5aFr7YOzzfm0EXsB7K:V6QFElP6n+gMQMOtEvwDpjyaYaFAh3W2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000122ee-10.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x000b0000000122ee-10.dat	CryptoLocker_set1

Executes dropped EXE 1 IoCs

pid	Process
2096	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2288	2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2096	2288	2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4.exe	28
PID 2288 wrote to memory of 2096	2288	2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4.exe	28
PID 2288 wrote to memory of 2096	2288	2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4.exe	28
PID 2288 wrote to memory of 2096	2288	2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4.exe	28

C:\Users\Admin\AppData\Local\Temp\2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4.exe
"C:\Users\Admin\AppData\Local\Temp\2d4419c6ee01751e2be6f97d80cdb1d94a87ff2117a2f0f41990ad62b7441fa4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
f208025739cc65fb28401cd3e2cf2e59

SHA1
b585d89906d6d305552953a1527ec518bef22b82

SHA256
f8ee50f785acf8b8bf445efc51e9970a9b0b649126d414d85ad77691ed04becd

SHA512
696954b7d441715fdb5277c09cb49e62f624705a17a442dacc0658b8843511a7decabc2f3ee7460e3f1f1b264071c7d5c38b1d2430c9a307aca2591303163fa1

Download Submit
memory/2096-15-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2096-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2288-0-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2288-1-0x0000000000470000-0x0000000000476000-memory.dmp

Filesize
24KB

Download
memory/2288-8-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download