92e0859302e0d703366c2566649a87b97ae271e62c10342892124a0142d666c0

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024061539e2673c4f5361eb98b5e4b06f8391a8cryptolocker.exe
Size

72KB
MD5

39e2673c4f5361eb98b5e4b06f8391a8
SHA1

19544f34a2801775800314db4798d2aacf0a1387
SHA256

92e0859302e0d703366c2566649a87b97ae271e62c10342892124a0142d666c0
SHA512

44d3f0f57fbc3073254f15934980d61ce699ff563f41e75a8fc94e99f98bf1f020c3ba6567f565182859c8f4430a2af15e457d587adc116481521fbbee085f29
SSDEEP

1536:Dk/xY0sllyGQMOtEvwDpjwycDtKkQZQRKb61vSbgZ3QzNKUNZO5F:DW60sllyWOtEvwDpjwF85U

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2976	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2292	2024061539e2673c4f5361eb98b5e4b06f8391a8cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2976	2292	2024061539e2673c4f5361eb98b5e4b06f8391a8cryptolocker.exe	28
PID 2292 wrote to memory of 2976	2292	2024061539e2673c4f5361eb98b5e4b06f8391a8cryptolocker.exe	28
PID 2292 wrote to memory of 2976	2292	2024061539e2673c4f5361eb98b5e4b06f8391a8cryptolocker.exe	28
PID 2292 wrote to memory of 2976	2292	2024061539e2673c4f5361eb98b5e4b06f8391a8cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024061539e2673c4f5361eb98b5e4b06f8391a8cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024061539e2673c4f5361eb98b5e4b06f8391a8cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:2976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
72KB

MD5
e1d43868583db952b5edb97101968dcf

SHA1
323bd32482f4c9dd159e677c6dac7dc7181b78d3

SHA256
27e6ad4e3249b6ff767d34217e8558e02a5e47bb92ab0f67205df87937450258

SHA512
94a545e101f5d7e5757acaf31054df6aaa9ea3268cc47ad0a40dae74389754893e3483e2a5328b803e2b8840c6e97fd3abcb748231d3de84149b2b742b39d419

Download Submit
memory/2292-0-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2292-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2292-2-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2292-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2292-15-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2976-16-0x0000000000500000-0x000000000050B000-memory.dmp

Filesize
44KB

Download
memory/2976-18-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download
memory/2976-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download