Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 17:38
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe
-
Size
39KB
-
MD5
d4c650239bc932a6eb4b40430175ad77
-
SHA1
85ae055d03c90df94cb4f665b95f151c5e9dd9a3
-
SHA256
01106d5ec49f56920729252a625cb7787347acb63963b2c52efb07375962d9fa
-
SHA512
5e6a506b2a9e4b0a21dd17e7e2e5abb29f6e01f5920874c86bd4b88b083e5aaf54b88f57299b8396e41054f712860d07e7853e7da17125d920989be815e14ac8
-
SSDEEP
768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6Dy8POKm:bIDOw9a0Dwo3P1ojvUSDh4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\lossy.exe CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
Processes:
lossy.exepid process 3068 lossy.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exepid process 1044 2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exedescription pid process target process PID 1044 wrote to memory of 3068 1044 2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe lossy.exe PID 1044 wrote to memory of 3068 1044 2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe lossy.exe PID 1044 wrote to memory of 3068 1044 2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe lossy.exe PID 1044 wrote to memory of 3068 1044 2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe lossy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
PID:3068
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5e0e09e420f9741109fe214abe645e81e
SHA1f5fe3cbcde0ae485ef8aeef7f898e24d046ec44c
SHA256fb27a51a078b152fa7089b17e629716db103e8371f95ce618d3dbe1b30c7ce1a
SHA512d8507a96717a9961bd0d587a3be5c661975605b4abad5af0f32250bf84fe904ee69600ca21248d4c909f7033e8678948690835989271704625ed89ed02247cec