81687ecb3d5168fdade47c446cf156537721c01eba1ce58263277d382a25746d

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-05-2024 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-15_2c9e55ddc087f32dab56b3f4f4d810c1_cryptolocker.exe
Size

42KB
MD5

2c9e55ddc087f32dab56b3f4f4d810c1
SHA1

d5228e0e20a720beb058b1bc96779801462b53d3
SHA256

81687ecb3d5168fdade47c446cf156537721c01eba1ce58263277d382a25746d
SHA512

fea9a09e8189fe191a846901551540da339d95e31536bd58534df0b461732bd0e6c1775b3fb86f35aa72376a5f7e1690ae657cda0b58bb9ed83898725e97b392
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAB:bCDOw9aMDooc+vAB

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/2924-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d00000001232e-11.dat	CryptoLocker_rule2
behavioral1/memory/2760-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2924-15-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2760-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2760	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2924	2024-05-15_2c9e55ddc087f32dab56b3f4f4d810c1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2760	2924	2024-05-15_2c9e55ddc087f32dab56b3f4f4d810c1_cryptolocker.exe	28
PID 2924 wrote to memory of 2760	2924	2024-05-15_2c9e55ddc087f32dab56b3f4f4d810c1_cryptolocker.exe	28
PID 2924 wrote to memory of 2760	2924	2024-05-15_2c9e55ddc087f32dab56b3f4f4d810c1_cryptolocker.exe	28
PID 2924 wrote to memory of 2760	2924	2024-05-15_2c9e55ddc087f32dab56b3f4f4d810c1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-15_2c9e55ddc087f32dab56b3f4f4d810c1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-15_2c9e55ddc087f32dab56b3f4f4d810c1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
42KB

MD5
8e85b41ee884f065642e0e17c4fde7d8

SHA1
88034c4c60e3d2176fc6689a8651abe2ed7c352f

SHA256
2b7bed0b8b55fcd7afd266e6acd6eea35f9032f6487c898b0ebeca0f235a78f1

SHA512
eb51404832071969b49dbf57c13d02636a0c5714c36df467ce739a3e81416cf4726265c416f8462c688c51d90c10971c129345a4175238b174c169b55c3211b6

Download Submit
memory/2760-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2760-18-0x0000000001C90000-0x0000000001C96000-memory.dmp

Filesize
24KB

Download
memory/2760-25-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2760-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2924-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2924-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2924-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2924-9-0x00000000001C0000-0x00000000001C6000-memory.dmp

Filesize
24KB

Download
memory/2924-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download