48c477f18ac39ca7114fe4e5c4d09da95d9b9675214d36729db9c17d67432fbb

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 20:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_c21c71861ad551dfc4223c02ee8d4248_cryptolocker.exe
Size

45KB
MD5

c21c71861ad551dfc4223c02ee8d4248
SHA1

eec99b9700b5fd07eaca3f474983f18aa4cb7337
SHA256

48c477f18ac39ca7114fe4e5c4d09da95d9b9675214d36729db9c17d67432fbb
SHA512

c7faef7f651adc9b951ce752826d1578a7ff62583e78c636a9ba015ca6173b3bc5c106b4d7a881e530a6ea14441130225dbb4af67d8c894c54fc929ff170b411
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPx9UnuDLlj:bIDOw9a0Dwo3P1ojvUSD4PInyj

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012252-13.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1708	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
384	2024-02-23_c21c71861ad551dfc4223c02ee8d4248_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 384 wrote to memory of 1708	384	2024-02-23_c21c71861ad551dfc4223c02ee8d4248_cryptolocker.exe	28
PID 384 wrote to memory of 1708	384	2024-02-23_c21c71861ad551dfc4223c02ee8d4248_cryptolocker.exe	28
PID 384 wrote to memory of 1708	384	2024-02-23_c21c71861ad551dfc4223c02ee8d4248_cryptolocker.exe	28
PID 384 wrote to memory of 1708	384	2024-02-23_c21c71861ad551dfc4223c02ee8d4248_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-23_c21c71861ad551dfc4223c02ee8d4248_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_c21c71861ad551dfc4223c02ee8d4248_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:384
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
45KB

MD5
e66dd7c9a2417d9f0560b068b5e4814f

SHA1
420306a6f61dab61f42cabe1be3e25ce274f38c4

SHA256
790387bf5ffa333635d2d79438b3d8ac2369f9fc1acd0b75463a9ec85d69d3bb

SHA512
6dd376b7d6bab9f3d1f9043d75fae1777c98ac5f45c490446036f8d595322df78596a61688b35acdb215f767aecc4e9b64bd9f57a75bd336d0bb334f7d779d26

Download Submit
memory/384-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/384-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/384-2-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1708-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download