dd561082ccb7a20aa5e1214f609cb7de50c4c320f440417953677229fbbe44ee

Analysis

max time kernel
150s
max time network
149s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 17:51

Target

2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe
Size

52KB
MD5

d16910d9df6b067699dd17acf8e71cd2
SHA1

39184b3299ef5e5b63fe9a0c64f1ceba52e063ac
SHA256

dd561082ccb7a20aa5e1214f609cb7de50c4c320f440417953677229fbbe44ee
SHA512

719a885825087ac66286c5c6b03a35000b80c685e086ba01e146300fae6138525f6862951497a2d68378d3fda318eb937e50fcb38a12d600298cf7931329b7ff
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTbqjm:bIDOw9a0DwitDZzcTmm

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\lossy.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

lossy.exe

pid process

2592 lossy.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe

pid process

2868 2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2592	lossy.exe

pid	process
2868	2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe

description	pid	process	target process
PID 2868 wrote to memory of 2592	2868	2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe	lossy.exe
PID 2868 wrote to memory of 2592	2868	2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe	lossy.exe
PID 2868 wrote to memory of 2592	2868	2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe	lossy.exe
PID 2868 wrote to memory of 2592	2868	2024-02-12_d16910d9df6b067699dd17acf8e71cd2_cryptolocker.exe	lossy.exe

C:\Users\Admin\AppData\Local\Temp\lossy.exe
"C:\Users\Admin\AppData\Local\Temp\lossy.exe"
2⤵
- Executes dropped EXE
PID:2592

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
52KB

MD5
7402a33727595f6999eef6cd79a8520c

SHA1
618f685a6529aad025587812ba646a5485b655cd

SHA256
96c3d37f650cbb37a085c42af0333f9335508db302a4509d7bc509b82e6177f9

SHA512
4258ed37ef649a4a0ef332d189a9531b7ba9eca3b994dc3ad45c9d62b9e09246668d4a5be00f581238bebd2e9dc88f6675ac051e5a95d55e6190d26ee2bb0c4b

Download Submit
memory/2592-15-0x0000000000800000-0x0000000000806000-memory.dmp

Filesize
24KB

Download
memory/2592-18-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2868-0-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2868-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2868-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download