374d6776b39b2d7367fbca43a4ecda739976d734716ea2531f9f39bd96eab5c1

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 17:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_7f9d16e7436c82652a7e2fe6fa5c661f_cryptolocker.exe
Size

45KB
MD5

7f9d16e7436c82652a7e2fe6fa5c661f
SHA1

3566bc0948fbd9aa87179b8297d4b3076a59346c
SHA256

374d6776b39b2d7367fbca43a4ecda739976d734716ea2531f9f39bd96eab5c1
SHA512

5bad5d47b454e73264e2113f71ccf2db3e7d99f7f8c4e849bc6cbdbc08d6c6c2a13dd69f6225d678ddbf85e3f58161b6ef256b86ac14674344ee63f1533e7219
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPx9UnuCmM:bIDOw9a0Dwo3P1ojvUSD4PInrmM

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001225c-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2660	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2108	2024-02-12_7f9d16e7436c82652a7e2fe6fa5c661f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2660	2108	2024-02-12_7f9d16e7436c82652a7e2fe6fa5c661f_cryptolocker.exe	28
PID 2108 wrote to memory of 2660	2108	2024-02-12_7f9d16e7436c82652a7e2fe6fa5c661f_cryptolocker.exe	28
PID 2108 wrote to memory of 2660	2108	2024-02-12_7f9d16e7436c82652a7e2fe6fa5c661f_cryptolocker.exe	28
PID 2108 wrote to memory of 2660	2108	2024-02-12_7f9d16e7436c82652a7e2fe6fa5c661f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-12_7f9d16e7436c82652a7e2fe6fa5c661f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_7f9d16e7436c82652a7e2fe6fa5c661f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
45KB

MD5
0348c80db9057b76e9f303e1a9c0fbea

SHA1
07b8d96b0e4ec014f1150791318b9f093e3e8edd

SHA256
1617603d4abbc0a94cea188dc04002160f2503b15ac052633d600aef661bfe50

SHA512
90a3a2a225c0f9058831b293eda97ccdc9730ae2e457cbb5431cf2cef437194d43a6dd9bde8c8dab1263070e25f2f6849e6ad09c7ce41968846dbe29dce59b1e

Download Submit
memory/2108-0-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2108-1-0x0000000001C90000-0x0000000001C96000-memory.dmp

Filesize
24KB

Download
memory/2108-8-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2660-16-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/2660-15-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download