c7a9c00935c18aba0e12e511cc242667e757f96cc32c1bca2fe7ae1a0df3ab24

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe
Size

40KB
MD5

02572f30f39d569f7343ab94549618af
SHA1

d439d1a265a6b571b645f3e45da98df6b463b086
SHA256

c7a9c00935c18aba0e12e511cc242667e757f96cc32c1bca2fe7ae1a0df3ab24
SHA512

acddb38d3f7b7e24fa17c77e7a3da5643556ee42c27e70c172c21e14d0da8f56a38b829715284bc19ec405c9a1f1b55e3a8a82117602a8f65aecdc4e6729c683
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6Dy8PE4:bIDOw9a0Dwo3P1ojvUSDhc4

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012252-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2376	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
1320	2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1320 wrote to memory of 2376	1320	2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe	28
PID 1320 wrote to memory of 2376	1320	2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe	28
PID 1320 wrote to memory of 2376	1320	2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe	28
PID 1320 wrote to memory of 2376	1320	2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-29_02572f30f39d569f7343ab94549618af_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1320
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
40KB

MD5
3b43ae917699374211956ddc525aeb48

SHA1
f0790df88aa5948d1771c6cdefaa9506c6d7888f

SHA256
bc1fa74d8bf4701931bd7ac3654d4264a90ccc023009a9455bec19c0c3079cdb

SHA512
a078a6d5e818c42905d5a8c2ccff3552b40e5ac7ed9900eebeac4a9fdbb1e2737a339be147485937aee925b65f43193404f555c4b94e953d201480f4f21aab98

Download Submit
memory/1320-0-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/1320-2-0x0000000000450000-0x0000000000456000-memory.dmp

Filesize
24KB

Download
memory/1320-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2376-15-0x0000000001C80000-0x0000000001C86000-memory.dmp

Filesize
24KB

Download
memory/2376-22-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download