f182bd4512cff1fe5029190d062d4a798770c7c2f2c8682b3ca92c72569f07e1

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/02/2024, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-03_f164130b08ee2d5c4cebf8c392c0c834_cryptolocker.exe
Size

51KB
MD5

f164130b08ee2d5c4cebf8c392c0c834
SHA1

dddc7357cc27c4331664ce0d5f9f9a3ee143b4ac
SHA256

f182bd4512cff1fe5029190d062d4a798770c7c2f2c8682b3ca92c72569f07e1
SHA512

5a017bf96c0878e06ad119fb14ccbe9ef4de7fed29d604d478f9787703861bc0aeeec5a9a390a8fce72218383acd5b40a4a8fd7b53b3555314ff50ec02735885
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9SVMT:bIDOw9a0DwitDZz16T

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001233b-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3004	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2140	2024-02-03_f164130b08ee2d5c4cebf8c392c0c834_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2140 wrote to memory of 3004	2140	2024-02-03_f164130b08ee2d5c4cebf8c392c0c834_cryptolocker.exe	28
PID 2140 wrote to memory of 3004	2140	2024-02-03_f164130b08ee2d5c4cebf8c392c0c834_cryptolocker.exe	28
PID 2140 wrote to memory of 3004	2140	2024-02-03_f164130b08ee2d5c4cebf8c392c0c834_cryptolocker.exe	28
PID 2140 wrote to memory of 3004	2140	2024-02-03_f164130b08ee2d5c4cebf8c392c0c834_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-03_f164130b08ee2d5c4cebf8c392c0c834_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_f164130b08ee2d5c4cebf8c392c0c834_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2140
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
51KB

MD5
2f06ec90c3c74d70f2fa92c29e061e12

SHA1
3098d8b720125be7934589bee17e140538403a49

SHA256
0196812231482d264cdada296f274bf486a33c860846c41c18cc3f67d5a6df13

SHA512
073f5a5b12e84c1f2f10b4d30d3ff644cfefa2846f248589b8799f2843116d389d54d3289c07869147f353f869e8a624822dd2f43a71d6f4dc0098d4562ddaaa

Download Submit
memory/2140-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2140-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2140-2-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/3004-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/3004-22-0x0000000000420000-0x0000000000426000-memory.dmp

Filesize
24KB

Download