50c76093027677230928c23c1d42a036755060ce029bf217c074a5fe2dbbd359

Analysis

max time kernel
151s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04-08-2023 16:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60e40086f4f9dd2ebbc68232176de227_cryptolocker_JC.exe
Size

49KB
MD5

60e40086f4f9dd2ebbc68232176de227
SHA1

bf7b8a9886b975cdcfed1d870c75fc315f7710ba
SHA256

50c76093027677230928c23c1d42a036755060ce029bf217c074a5fe2dbbd359
SHA512

220d8d6a950d54f9a52ce84d2f86751aa547b5a8f2dd87a6df61abe3b736e90e2c5061338b3d9ed09fe25afad743081758a966c47863facb7eed2de6d919ec82
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4UsCOTcbJoB9p:bIDOw9a0DwitDkvmoLp

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3040	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1104 wrote to memory of 3040	1104	60e40086f4f9dd2ebbc68232176de227_cryptolocker_JC.exe	80
PID 1104 wrote to memory of 3040	1104	60e40086f4f9dd2ebbc68232176de227_cryptolocker_JC.exe	80
PID 1104 wrote to memory of 3040	1104	60e40086f4f9dd2ebbc68232176de227_cryptolocker_JC.exe	80

C:\Users\Admin\AppData\Local\Temp\60e40086f4f9dd2ebbc68232176de227_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\60e40086f4f9dd2ebbc68232176de227_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1104
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
49KB

MD5
260041904d45761e80d6e8b833775831

SHA1
285cd81575bd7d396d5a482670f62859531eb771

SHA256
8f2791f295dd4884b47825adc8e58c2d5c3899cfcc22f8ed6d409fb0a11587d4

SHA512
7819a96a79a06eaf37ae0598e3e58b655152ac02784c3230ee948200d4ef35a9620b5392c6c84c5375143dca09e362f6f20477377f3c90547d1312ddc39fdd55

Download Submit
C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
49KB

MD5
260041904d45761e80d6e8b833775831

SHA1
285cd81575bd7d396d5a482670f62859531eb771

SHA256
8f2791f295dd4884b47825adc8e58c2d5c3899cfcc22f8ed6d409fb0a11587d4

SHA512
7819a96a79a06eaf37ae0598e3e58b655152ac02784c3230ee948200d4ef35a9620b5392c6c84c5375143dca09e362f6f20477377f3c90547d1312ddc39fdd55

Download Submit
C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
49KB

MD5
260041904d45761e80d6e8b833775831

SHA1
285cd81575bd7d396d5a482670f62859531eb771

SHA256
8f2791f295dd4884b47825adc8e58c2d5c3899cfcc22f8ed6d409fb0a11587d4

SHA512
7819a96a79a06eaf37ae0598e3e58b655152ac02784c3230ee948200d4ef35a9620b5392c6c84c5375143dca09e362f6f20477377f3c90547d1312ddc39fdd55

Download Submit
memory/1104-133-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download
memory/1104-134-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download
memory/1104-135-0x0000000002170000-0x0000000002176000-memory.dmp

Filesize
24KB

Download
memory/3040-151-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/3040-150-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/3040-157-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download