a594458be002964faeb265cd983649da127b795e92d0bf1f2ce359693f2ed291

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
15/06/2024, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe
Size

47KB
MD5

a1af3f97d301f9f381cd9ac1d9861f21
SHA1

d5ae9101fcf1d767984539ff0014f0341b88a4b1
SHA256

a594458be002964faeb265cd983649da127b795e92d0bf1f2ce359693f2ed291
SHA512

76b81eed9239eceb75f52082753ab0b6e5eb6d6978639de231e50bbf535a3660a5f7f8ed7b48f7fae5606c27ecc221872067c444251f0800ace151aa8290f953
SSDEEP

384:e/4wODQkzonAYsju5N/surDQtOOtEvwDpjqIGROqS/WccJVJwi2B5oCCM8CLW2Vp:79inqyNR/QtOOtEvwDpjBKccJVODvy3Y

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3040	asih.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 3040	2924	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe	28
PID 2924 wrote to memory of 3040	2924	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe	28
PID 2924 wrote to memory of 3040	2924	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe	28
PID 2924 wrote to memory of 3040	2924	20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\20240615a1af3f97d301f9f381cd9ac1d9861f21cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\asih.exe
  "C:\Users\Admin\AppData\Local\Temp\asih.exe"
  2⤵
  - Executes dropped EXE
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\asih.exe

Filesize
47KB

MD5
a3cebacd627ecf8ff10eff90befffc8c

SHA1
a0d6148a7876acf64f5a4f0cc73ac4b3ce1e8824

SHA256
ee175a83ea2bebff4da5d5bc5da60c0e95142a614f36ba997f608b74de578b80

SHA512
37990b5bfa719af0005025b0b59783529bb53ab49b5c692adb99cf774a996cf097af59bea51418870198acdb82f2c7e1947710534fc91660989a8bda0c4e7202

Download Submit
memory/2924-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2924-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2924-2-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2924-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2924-15-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3040-17-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/3040-24-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/3040-25-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download