ee8571fbb1ba953683bd25e08006cd03fbddd22b73e92b544b9dc1d28f201498

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 06:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-20_a6505de74f6790f465612a07a4153d38_cryptolocker.exe
Size

53KB
MD5

a6505de74f6790f465612a07a4153d38
SHA1

64df11662698c3e80cecfa7d19f319d4c5e089e8
SHA256

ee8571fbb1ba953683bd25e08006cd03fbddd22b73e92b544b9dc1d28f201498
SHA512

a5832ec02cde59371508145ca094a2e47f35fa338158c4040493694b188b9c9bbe2a7cb72dc4da70f720d6bd1be02e19b7c8194b571f4c4bf16bef0600a8c5e9
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTbmhTBp:bIDOw9a0DwitDZzcTS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014395-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2948	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2968	2024-02-20_a6505de74f6790f465612a07a4153d38_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2948	2968	2024-02-20_a6505de74f6790f465612a07a4153d38_cryptolocker.exe	28
PID 2968 wrote to memory of 2948	2968	2024-02-20_a6505de74f6790f465612a07a4153d38_cryptolocker.exe	28
PID 2968 wrote to memory of 2948	2968	2024-02-20_a6505de74f6790f465612a07a4153d38_cryptolocker.exe	28
PID 2968 wrote to memory of 2948	2968	2024-02-20_a6505de74f6790f465612a07a4153d38_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-20_a6505de74f6790f465612a07a4153d38_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-20_a6505de74f6790f465612a07a4153d38_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
53KB

MD5
b180b24772bd2904c9b957f55ae28100

SHA1
0c99cd1ffcaf70a0427b92193c090297cf091e69

SHA256
c37985613b02ea9548f02e00887875a3a0a2a3545d00871ce916271ece9865ce

SHA512
0dd6002e82a2e758acb497094858b222bd7979e196710b14b3b42a4691532600ca5ceec3628fe6bbbe688c335ab7e13113421593728d25914e187001d3a41b66

Download Submit
memory/2948-15-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2948-17-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2968-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2968-1-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/2968-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download