77f88065c8aa00d01314d138dc1e7c147a0151a74e879c34cc72c92ba4066d66

Analysis

max time kernel
150s
max time network
154s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
31/05/2024, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

202405315f3727e34a9a888256d0492738cac4b3cryptolocker.exe
Size

54KB
MD5

5f3727e34a9a888256d0492738cac4b3
SHA1

36a47645893fc55ff53b280d681a2a04d029c766
SHA256

77f88065c8aa00d01314d138dc1e7c147a0151a74e879c34cc72c92ba4066d66
SHA512

7bbf7c54a8e7769ef4e4b0c801cfe25fe3f3af5953b2822502781be4298eacdded08543731462aec75ef4a1914108bdb9e62d18041093e43c00defb2da1d08d8
SSDEEP

1536:V6QFElP6n+gMQMOtEvwDpjeJQ7pojaklPs6:V6a+pOtEvwDpjG

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2696	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
1612	202405315f3727e34a9a888256d0492738cac4b3cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 2696	1612	202405315f3727e34a9a888256d0492738cac4b3cryptolocker.exe	28
PID 1612 wrote to memory of 2696	1612	202405315f3727e34a9a888256d0492738cac4b3cryptolocker.exe	28
PID 1612 wrote to memory of 2696	1612	202405315f3727e34a9a888256d0492738cac4b3cryptolocker.exe	28
PID 1612 wrote to memory of 2696	1612	202405315f3727e34a9a888256d0492738cac4b3cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\202405315f3727e34a9a888256d0492738cac4b3cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\202405315f3727e34a9a888256d0492738cac4b3cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
54KB

MD5
3937d67242d2a3c396d5fc2632c0bcce

SHA1
d7bf17f919c9781ef69f57d4a463b4be6b3f39f0

SHA256
272bfb322007d9bfb41c5ddcff4e2bf20236156b92fe5702f03da2dd54c6a279

SHA512
a64a3b5be20bf99e9ae42f83217056305a212c1be5162e4f6ed8d9aef3e0665c48acc7ac3f6a047dd58be44c6d59e1cdeb376ceeec466e72e81d78d6563029ef

Download Submit
memory/1612-0-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1612-8-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download
memory/1612-1-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download