5e23324643cb25bced58d86f5db882bb662add439004f550fec836efd1edb76e

Analysis

max time kernel
149s
max time network
153s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
11/05/2024, 20:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-11_22f84ec802be3fff8e3e2a1b0eecff69_cryptolocker.exe
Size

54KB
MD5

22f84ec802be3fff8e3e2a1b0eecff69
SHA1

48d7a5bac0cd7e9c74451dbb31745e4c8090a83a
SHA256

5e23324643cb25bced58d86f5db882bb662add439004f550fec836efd1edb76e
SHA512

aac23f68152786169125c7aaccf7e746975a3eb826cf390adad8990c270746b4b3bbe52c668a59d568df338a1a205f3a5d364b8ad5f0a1a333b397e3f30f2c35
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9Xv+mb6uXsl:bIDOw9a0DwitDZzc16j

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012289-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2604	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2400	2024-05-11_22f84ec802be3fff8e3e2a1b0eecff69_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2604	2400	2024-05-11_22f84ec802be3fff8e3e2a1b0eecff69_cryptolocker.exe	28
PID 2400 wrote to memory of 2604	2400	2024-05-11_22f84ec802be3fff8e3e2a1b0eecff69_cryptolocker.exe	28
PID 2400 wrote to memory of 2604	2400	2024-05-11_22f84ec802be3fff8e3e2a1b0eecff69_cryptolocker.exe	28
PID 2400 wrote to memory of 2604	2400	2024-05-11_22f84ec802be3fff8e3e2a1b0eecff69_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-11_22f84ec802be3fff8e3e2a1b0eecff69_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-11_22f84ec802be3fff8e3e2a1b0eecff69_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
54KB

MD5
f8b90422be5b06efe89f44fd1917ad66

SHA1
b1d2b3d3915cb2a990771fa70319d2e32b1d9bc5

SHA256
7fbaeccae7a95eb3254a7f7eb884e9aa903d58f30be9926b79bbad08b7bb3baf

SHA512
c8f294dff789d934b9304cd16de1fe049293e6510a19339b7b6b501d9350722cab3b0d8839a14f0110d22e81d4cef6abcea43916b6279136399a682fa1669c74

Download Submit
memory/2400-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2400-8-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2400-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2604-15-0x0000000000880000-0x0000000000886000-memory.dmp

Filesize
24KB

Download
memory/2604-22-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download