dbdc62e79a3a5a061739573a18819f09efe55484773aee884feb8349b83c4b9a

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 19:03

Target

20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe
Size

64KB
MD5

dd46f1ef2a469ebedc8ba365559a1bd3
SHA1

44cff1885b3f35d860fd4f375985aff62001e454
SHA256

dbdc62e79a3a5a061739573a18819f09efe55484773aee884feb8349b83c4b9a
SHA512

aa79e513e29f1f0cb3e2aa801a7353f7305d6f7999d3c25788f07952e3517ac394fcdd06a91c9ce33066b58758fb502cd66e24347c759b2569697e38140a3e00
SSDEEP

1536:qmbhXDmjr5MOtEvwDpj5cDtKkQZQRKb61vSbgtsiv:BbdDmjr+OtEvwDpjM8a

Score

7^/10

Executes dropped EXE 1 IoCs

Processes:

asih.exe

pid process

1984 asih.exe
Loads dropped DLL 1 IoCs

Processes:

20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe

pid process

1008 20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1984	asih.exe

pid	process
1008	20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe

description	pid	process	target process
PID 1008 wrote to memory of 1984	1008	20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe	asih.exe
PID 1008 wrote to memory of 1984	1008	20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe	asih.exe
PID 1008 wrote to memory of 1984	1008	20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe	asih.exe
PID 1008 wrote to memory of 1984	1008	20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe	asih.exe

C:\Users\Admin\AppData\Local\Temp\20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240521dd46f1ef2a469ebedc8ba365559a1bd3cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:1984

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
64KB

MD5
776dcb057f3ea35e896334ea35ccc4f4

SHA1
541e8b75be706562b3e7eea435943edcbc249492

SHA256
54f4bcef1f2b25cad1818280a13c95547a29397cc1a3000f93785badad922ebf

SHA512
d21953409161d8074c58dd5e0f4da45ab0a8a3dbfc75313549dad4a8172a4cee881a9236bc5d40c9f766f0bddcf7f59e40458c1cfa6b0d708302febf6b38194f

Download Submit
memory/1008-2-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/1008-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1008-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1008-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1008-16-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1984-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1984-19-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1984-26-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1984-27-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download