7cf35b25c6a7ff00b1bdfe2e60ce123477dcf707748a5cec547448c17bcf061f

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 11:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_baf2a820c8f45891451048d82e45828f_cryptolocker.exe
Size

40KB
MD5

baf2a820c8f45891451048d82e45828f
SHA1

d4e7da161b01b2307ba6c6856ed9b79e0d047ab7
SHA256

7cf35b25c6a7ff00b1bdfe2e60ce123477dcf707748a5cec547448c17bcf061f
SHA512

d68c660a63a732641c0bcafdbe1b39616f1a51df7320bba8c3ade47cec2256e3709319311976eaa8518275545e5320fdca8cf32473f673252783c79d0059a0b6
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6DyE9xC:bIDOw9a0Dwo3P1ojvUSD79A

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000012256-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2520	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2088	2024-04-10_baf2a820c8f45891451048d82e45828f_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2520	2088	2024-04-10_baf2a820c8f45891451048d82e45828f_cryptolocker.exe	28
PID 2088 wrote to memory of 2520	2088	2024-04-10_baf2a820c8f45891451048d82e45828f_cryptolocker.exe	28
PID 2088 wrote to memory of 2520	2088	2024-04-10_baf2a820c8f45891451048d82e45828f_cryptolocker.exe	28
PID 2088 wrote to memory of 2520	2088	2024-04-10_baf2a820c8f45891451048d82e45828f_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-10_baf2a820c8f45891451048d82e45828f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_baf2a820c8f45891451048d82e45828f_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
40KB

MD5
0cd721d6e08659bf84fa842b25394d47

SHA1
094aff9c10204996081911b4bbbdbe39d6e7b6be

SHA256
cde9847e4530b08846ccc074c2d3c0f8f3b844a7a36544a738c7dc54d95a6f18

SHA512
34655039506c4f7028c637860359f840d66deb896faef8007a0695dd715c14187e87bac07ab9b2c21c15eae6a442f7d4dbbb431d74654db7bdb03b74fda127bf

Download Submit
memory/2088-0-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2088-1-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2088-3-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2520-15-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/2520-17-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download