4c36c579ba0171202f7239f039098caf70e0bb6402d6813f051aa5f64e50b3f3

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
04-01-2024 15:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-03_028a6a1c3205aa494f9edd8c3d500b16_cryptolocker.exe
Size

45KB
MD5

028a6a1c3205aa494f9edd8c3d500b16
SHA1

d497171c91710a79267d38f1937a6bf7a4a8cdd7
SHA256

4c36c579ba0171202f7239f039098caf70e0bb6402d6813f051aa5f64e50b3f3
SHA512

154f764f12dfcdcad5ba3834995a6dd29d0df25fa8c229a64f301ce391944fcf1b507e5e5e952b2b05041aa882e6b31233fa629dde4ac25345a5518a47f39fd9
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPxyV4tF3zSLh:bIDOw9a0Dwo3P1ojvUSD4PRtF3zSLh

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2692	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2672	2024-01-03_028a6a1c3205aa494f9edd8c3d500b16_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2692	2672	2024-01-03_028a6a1c3205aa494f9edd8c3d500b16_cryptolocker.exe	28
PID 2672 wrote to memory of 2692	2672	2024-01-03_028a6a1c3205aa494f9edd8c3d500b16_cryptolocker.exe	28
PID 2672 wrote to memory of 2692	2672	2024-01-03_028a6a1c3205aa494f9edd8c3d500b16_cryptolocker.exe	28
PID 2672 wrote to memory of 2692	2672	2024-01-03_028a6a1c3205aa494f9edd8c3d500b16_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-03_028a6a1c3205aa494f9edd8c3d500b16_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-03_028a6a1c3205aa494f9edd8c3d500b16_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
46KB

MD5
feaa95eab75bb68a2bbb869537a62133

SHA1
2dfc32e19ea94741e4115e1fa3d44035b4e7feb6

SHA256
cffce900853ae0dacb4cf904ff57fa98b62cfc512575c8c23deb0853e96945ed

SHA512
26cfdc5f8aebc9cb71b2330d2cae3c97eaa1171bb2ea1051505188b152bfd26f3d32f256fc5c3b32bfc5ee68c0739379d0780f0a88620c827b06a65a2020446f

Download Submit
memory/2672-0-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2672-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2672-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2692-15-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2692-18-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download