60c8e26ee0cd421f7252a6261548dd9b64260c361f0fa5929724d02fbf0a3f47

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05-03-2024 14:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-05_4051c846c85ee8f1fdf6fa6d5735e705_cryptolocker.exe
Size

41KB
MD5

4051c846c85ee8f1fdf6fa6d5735e705
SHA1

2d664ca0b7a54e5aa9e83f42254d00fe0623d1f1
SHA256

60c8e26ee0cd421f7252a6261548dd9b64260c361f0fa5929724d02fbf0a3f47
SHA512

b50844d4bd176b03415f421308c04dfebdeb1a3ef74bc21f78ff37acf4ad2e20d66a961abc974bb7f68f38408361128d701d17258162f0bd98ae002c8ebf3ed7
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6Dy8POK8D:bIDOw9a0Dwo3P1ojvUSDh2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012251-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2512	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2100	2024-03-05_4051c846c85ee8f1fdf6fa6d5735e705_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2512	2100	2024-03-05_4051c846c85ee8f1fdf6fa6d5735e705_cryptolocker.exe	28
PID 2100 wrote to memory of 2512	2100	2024-03-05_4051c846c85ee8f1fdf6fa6d5735e705_cryptolocker.exe	28
PID 2100 wrote to memory of 2512	2100	2024-03-05_4051c846c85ee8f1fdf6fa6d5735e705_cryptolocker.exe	28
PID 2100 wrote to memory of 2512	2100	2024-03-05_4051c846c85ee8f1fdf6fa6d5735e705_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-05_4051c846c85ee8f1fdf6fa6d5735e705_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_4051c846c85ee8f1fdf6fa6d5735e705_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
41KB

MD5
673647ec2871caf767c8ec3c85bd0c02

SHA1
0710ed2f578f1fd930f0ac0a4fde0347a0659a68

SHA256
75791188b40efaa32cea5ee11644323bcee8d5d2b1ad22d9499a879e4bf2a1e8

SHA512
439033c1091dd7cd692899a56946c6d83a22c79db6789d74d8ac0fc6cb32f15b54ea2be162f364005e831b02b47f744da39baa458e98db67e40e9e8b5e889eb1

Download Submit
memory/2100-0-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2100-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2100-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2512-15-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2512-17-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download