4d230de5326918901838063c0b143366cfa49e81c0bbe939036e6ff4a7fcfea9

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
04/08/2023, 16:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e1033eeedca50bd809079924952c844_cryptolocker_JC.exe
Size

49KB
MD5

5e1033eeedca50bd809079924952c844
SHA1

31473d0f56b5538f19fe054714f92d1237ae8047
SHA256

4d230de5326918901838063c0b143366cfa49e81c0bbe939036e6ff4a7fcfea9
SHA512

efe74920c5dd0753119292231b0cd768c65ecd1c22e7f3c36a97d47ffb7c6395c2ada1efbd1c7337f5181d9ec99a78985029742bdf3e602f5691cb0b71518066
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBC1SleZWD:bIDOw9a0DwitDZ0leoD

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1204	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2572	5e1033eeedca50bd809079924952c844_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1204	2572	5e1033eeedca50bd809079924952c844_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 1204	2572	5e1033eeedca50bd809079924952c844_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 1204	2572	5e1033eeedca50bd809079924952c844_cryptolocker_JC.exe	28
PID 2572 wrote to memory of 1204	2572	5e1033eeedca50bd809079924952c844_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\5e1033eeedca50bd809079924952c844_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\5e1033eeedca50bd809079924952c844_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:1204

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
49KB

MD5
79c9aa40bfe39e923714b18355636ddc

SHA1
8430458483fcfec04ccb5081c600ad7121c4090a

SHA256
09482be53d4f8918ce9f9b648dc4eaaa768c39e1fb65eb5fb5d4cc6a7ca8bed0

SHA512
92e3b44dd64485bc82b2f84c5a257c124be4099d833e5f6f5daeeeeede99b49eb138ac7c3faec4f4faabe562cb4c0af2d5a435a09b8cd7bd35ae36b69e42cedc

Download Submit
C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
49KB

MD5
79c9aa40bfe39e923714b18355636ddc

SHA1
8430458483fcfec04ccb5081c600ad7121c4090a

SHA256
09482be53d4f8918ce9f9b648dc4eaaa768c39e1fb65eb5fb5d4cc6a7ca8bed0

SHA512
92e3b44dd64485bc82b2f84c5a257c124be4099d833e5f6f5daeeeeede99b49eb138ac7c3faec4f4faabe562cb4c0af2d5a435a09b8cd7bd35ae36b69e42cedc

Download Submit
\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
49KB

MD5
79c9aa40bfe39e923714b18355636ddc

SHA1
8430458483fcfec04ccb5081c600ad7121c4090a

SHA256
09482be53d4f8918ce9f9b648dc4eaaa768c39e1fb65eb5fb5d4cc6a7ca8bed0

SHA512
92e3b44dd64485bc82b2f84c5a257c124be4099d833e5f6f5daeeeeede99b49eb138ac7c3faec4f4faabe562cb4c0af2d5a435a09b8cd7bd35ae36b69e42cedc

Download Submit
memory/1204-70-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/1204-69-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2572-54-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2572-56-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2572-55-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download