7f9444082f61ad95291fef7ad558b9350068fdde2f69d0dd03cc639e8a04bb17

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
21-05-2024 16:04

Target

2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe
Size

43KB
MD5

ef3a4afdc08152efabb508e78ea6929d
SHA1

b3941022e8c3dd3187c800146b5ce5c8855c0519
SHA256

7f9444082f61ad95291fef7ad558b9350068fdde2f69d0dd03cc639e8a04bb17
SHA512

78ef1c34827bc98455aa2e08db17d2ae0fe7d0a50ac9a607a9ce7462adddc4a54e6eb89222eaa8fd12ff97a230afd173bd4760689c50c00b3ab23c9d66c39708
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAIie0w:bCDOw9aMDooc+vAlc

Score

9^/10

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1596-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\lossy.exe	CryptoLocker_rule2
behavioral1/memory/1596-15-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2300-25-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

lossy.exe

pid process

2300 lossy.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe

pid process

1596 2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2300	lossy.exe

pid	process
1596	2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe

description	pid	process	target process
PID 1596 wrote to memory of 2300	1596	2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe	lossy.exe
PID 1596 wrote to memory of 2300	1596	2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe	lossy.exe
PID 1596 wrote to memory of 2300	1596	2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe	lossy.exe
PID 1596 wrote to memory of 2300	1596	2024-05-21_ef3a4afdc08152efabb508e78ea6929d_cryptolocker.exe	lossy.exe

C:\Users\Admin\AppData\Local\Temp\lossy.exe
"C:\Users\Admin\AppData\Local\Temp\lossy.exe"
2⤵
- Executes dropped EXE
PID:2300

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
43KB

MD5
f9bcf747c988dae82d45f270408a6f9c

SHA1
5e01ce2709a4875f932ec6de7c6b2fe0af61990c

SHA256
b5beb9547b700a27c2db117ae88c90d8b3c68de138ea3394cc986ed8c68f92f3

SHA512
cbe080424d897cd421dbf08e7c26ffa865368739ec93c6179af6bafda06c5f44a55247d226be205ca0935a7d7bc05c45766a82c304105dd5dabec46465947fb1

Download Submit
memory/1596-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1596-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1596-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1596-2-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/1596-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2300-24-0x00000000001E0000-0x00000000001E6000-memory.dmp

Filesize
24KB

Download
memory/2300-17-0x0000000001C10000-0x0000000001C16000-memory.dmp

Filesize
24KB

Download
memory/2300-25-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download