f7b6bdc0a07940881a59ad71ade8ca9abe2d5bf9252d6e232f4939a43105f0f5

Analysis

max time kernel
149s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
27-04-2024 22:22

Target

2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe
Size

54KB
MD5

01775a7cc02daeec95be36d5f2574129
SHA1

7c22a368771e137ab6406b9333f7dd4c5e13dad7
SHA256

f7b6bdc0a07940881a59ad71ade8ca9abe2d5bf9252d6e232f4939a43105f0f5
SHA512

1bd6bef2ede92742f65b425529dcbf00ce0f8a66fb7ba92d581c0420378b8457e39e875146bd63738e7e17a050c6a1012ae6928eb2b7f8cd9945ce568e398f61
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTb8pu6:bIDOw9a0DwitDZzcTL6

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\lossy.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

lossy.exe

pid process

2976 lossy.exe
Loads dropped DLL 1 IoCs

Processes:

2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe

pid process

2292 2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2976	lossy.exe

pid	process
2292	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe

description	pid	process	target process
PID 2292 wrote to memory of 2976	2292	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe	lossy.exe
PID 2292 wrote to memory of 2976	2292	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe	lossy.exe
PID 2292 wrote to memory of 2976	2292	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe	lossy.exe
PID 2292 wrote to memory of 2976	2292	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe	lossy.exe

C:\Users\Admin\AppData\Local\Temp\lossy.exe
"C:\Users\Admin\AppData\Local\Temp\lossy.exe"
2⤵
- Executes dropped EXE
PID:2976

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\lossy.exe
Filesize
54KB

MD5
9179a159c7ab094c609712bbc91c7d19

SHA1
57621de66819d9f42a4021f4389320f6b7dd13cf

SHA256
8cacff8cf748a18aae522f8a8cc287356194f4def38872f26f468c080b77bc08

SHA512
b486f5c1c9293a98b87ad0c171d642fe63defd6c53817270b5fc34bebad76396caada3d5c0cb3689a1fb04bc633c056208e2237395c58d56126ffaa94984af4d

Download Submit
memory/2292-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2292-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2292-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2976-15-0x0000000001BB0000-0x0000000001BB6000-memory.dmp

Filesize
24KB

Download
memory/2976-22-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download