cbff931e21cfa1b5b830b9f2474848d7b0db3ea303976e12412d946c64e1ac66

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
21-04-2024 01:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-21_1526adf377cec9e97f83607caa59c678_cryptolocker.exe
Size

41KB
MD5

1526adf377cec9e97f83607caa59c678
SHA1

3a18e8b708b5a970c92595361f837bde16ca7d51
SHA256

cbff931e21cfa1b5b830b9f2474848d7b0db3ea303976e12412d946c64e1ac66
SHA512

caf66a798a0486a976c61dfaf19db74a18af8a7863d38bfd9ed5822cba9e9e5f812e5fa10bd04be69a2dab53c99768230fa07ce6221f43039d476cd82acb2d38
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAHR:bCDOw9aMDooc+vAx

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2192-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000b00000001224f-11.dat	CryptoLocker_rule2
behavioral1/memory/2192-15-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2492-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2492-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2492	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2192	2024-04-21_1526adf377cec9e97f83607caa59c678_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 2492	2192	2024-04-21_1526adf377cec9e97f83607caa59c678_cryptolocker.exe	28
PID 2192 wrote to memory of 2492	2192	2024-04-21_1526adf377cec9e97f83607caa59c678_cryptolocker.exe	28
PID 2192 wrote to memory of 2492	2192	2024-04-21_1526adf377cec9e97f83607caa59c678_cryptolocker.exe	28
PID 2192 wrote to memory of 2492	2192	2024-04-21_1526adf377cec9e97f83607caa59c678_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-21_1526adf377cec9e97f83607caa59c678_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-21_1526adf377cec9e97f83607caa59c678_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
41KB

MD5
be44dba9634c18b5d71990342c529561

SHA1
abf058b67828fb3fae7cbab93aaad453adb5904c

SHA256
e39ae41af9c0b4edd0fdc42e75dd39deb709f53ce47b3633a035247d52c0d6d5

SHA512
74b6e26188085ce85d2e92f1fe8c8cff3063198b49d36cb26e04edb8eea46651a245d67084fee7447a9ec4d8b5abedf24d28c9af8a76fa8085d810bc5ac879ee

Download Submit
memory/2192-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2192-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2192-2-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2192-5-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/2192-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2492-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2492-18-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2492-19-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2492-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download