d96e98277d80358062e96515949514e8242333948dba8eb66b098d32b6c6bed0

Analysis

max time kernel
161s
max time network
168s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
02-02-2024 04:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-02_85257cccf490df75ebe7715d422a8688_cryptolocker.exe
Size

52KB
MD5

85257cccf490df75ebe7715d422a8688
SHA1

d43683ed478d019ecc6863a729421f08ebb9d60f
SHA256

d96e98277d80358062e96515949514e8242333948dba8eb66b098d32b6c6bed0
SHA512

d28b0909a6fdde96a9119bf58d33ac0f28526c4c510427f4cad85cc43a9a51860702424d0d9417f5c34adcf4863dda4d23212769f7c30d98d265947c2620ad94
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTbmhTG:bIDOw9a0DwitDZzcTr

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000016577-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2780	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2080	2024-02-02_85257cccf490df75ebe7715d422a8688_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 2780	2080	2024-02-02_85257cccf490df75ebe7715d422a8688_cryptolocker.exe	27
PID 2080 wrote to memory of 2780	2080	2024-02-02_85257cccf490df75ebe7715d422a8688_cryptolocker.exe	27
PID 2080 wrote to memory of 2780	2080	2024-02-02_85257cccf490df75ebe7715d422a8688_cryptolocker.exe	27
PID 2080 wrote to memory of 2780	2080	2024-02-02_85257cccf490df75ebe7715d422a8688_cryptolocker.exe	27

C:\Users\Admin\AppData\Local\Temp\2024-02-02_85257cccf490df75ebe7715d422a8688_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-02_85257cccf490df75ebe7715d422a8688_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
52KB

MD5
95756bbae692ca14b95c54c48ac238ed

SHA1
0d6f5d733bbb4fd9ebc0e251bcf22ae1e2573ee1

SHA256
ce618be9eedadf0895146ac6e87ed63c2e126c4eb17712de37d1ce8ecabadb62

SHA512
5d4058ac99bde597dac60865c351d9b7ff8f4ec21f2d8dbe1c370ce5652ac1b579bf23268e7e7fc9e369e4d94cf43520e46f4c51fe412e64b7aec5b500d80fa3

Download Submit
memory/2080-0-0x0000000001BD0000-0x0000000001BD6000-memory.dmp

Filesize
24KB

Download
memory/2080-1-0x0000000001C00000-0x0000000001C06000-memory.dmp

Filesize
24KB

Download
memory/2080-2-0x0000000001BD0000-0x0000000001BD6000-memory.dmp

Filesize
24KB

Download
memory/2780-16-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2780-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download