539403e9436be76660d24864148f33496553e02b30effc4a4ff31d796962a946

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:27

Target

20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe
Size

97KB
MD5

e10b73267a88f0c40a5bf5bc88141e40
SHA1

d7c94a82e3ed3eb9dbacb84890b66c116b82505f
SHA256

539403e9436be76660d24864148f33496553e02b30effc4a4ff31d796962a946
SHA512

599d63882f59c2eac4be669dd2b857dc3c384be908b769f33ca910b0fd11aea373a2ccc85520387106fe3b1076d5eadd6b744068392c086d10861a8c3122a836
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjQGYQbN/PKwNgp0WG:V6a+pOtEvwDpjtzJ

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

2468 asih.exe
Loads dropped DLL 1 IoCs

Processes:

20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe

pid process

2988 20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2468	asih.exe

pid	process
2988	20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe

description	pid	process	target process
PID 2988 wrote to memory of 2468	2988	20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe	asih.exe
PID 2988 wrote to memory of 2468	2988	20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe	asih.exe
PID 2988 wrote to memory of 2468	2988	20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe	asih.exe
PID 2988 wrote to memory of 2468	2988	20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521e10b73267a88f0c40a5bf5bc88141e40cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2988
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2468

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
97KB

MD5
d12910a8178aa804f123279b1f16fa9b

SHA1
2aaee1101d9b3acf0cd5c528f6ed40cf5da69744

SHA256
15940d67418b78ee68b269f004499e35764e7a15ea7b5231f7bc2a5ead73d1cb

SHA512
797613a13a40969b447c2e277083df0a2c2be3a08650dd990ec8454287aef288038573aa42738e4cc7e9bea63cee9e8b142c25316ae6597e22bf5efd031a4078

Download Submit
memory/2468-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2468-15-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2988-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2988-1-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2988-8-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download