Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240508-en
  • resource tags

    arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 05:49

General

  • Target

    2024-05-22_4bd612d5f6e754063ae0f2b41af31914_cryptolocker.exe

  • Size

    53KB

  • MD5

    4bd612d5f6e754063ae0f2b41af31914

  • SHA1

    b66c0a5c4f6b0eac6fc21a0a51ff1b0594510258

  • SHA256

    3e7dcc26718ef626001b2886ecd99e272ad1b8780b32ab36bada2bfb0a646afb

  • SHA512

    db449c051e518e267320ebae0c11010010431b97016916a087bef9fc3c183cc9cdaa2293b1c506f1681b6d55cd1e522ac3b6273371fc1927d7684266473844ad

  • SSDEEP

    768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtOXI:bODOw9acifAoc+vD

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_4bd612d5f6e754063ae0f2b41af31914_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_4bd612d5f6e754063ae0f2b41af31914_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3040

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    53KB

    MD5

    d404bd23e5a71e392e83f451be15406b

    SHA1

    0553f8376f6396b8dc15e765ad78e8f1db4a7a76

    SHA256

    84576dafb0dcb91fb1af41752754d0e3c78c81d24a77e956829a32fb8c2387a0

    SHA512

    de8fd7c8150d501e6aa94e65e88b2ed5057ecc3c0db6e20e267a26f846fd6af099ce0b46f119eb261d1a15d9c34440bf4452b13175520e1aa0583b702fcbf8f8

  • memory/1612-0-0x0000000008000000-0x000000000800F000-memory.dmp

    Filesize

    60KB

  • memory/1612-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/1612-2-0x0000000000310000-0x0000000000316000-memory.dmp

    Filesize

    24KB

  • memory/1612-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

    Filesize

    24KB

  • memory/1612-15-0x0000000008000000-0x000000000800F000-memory.dmp

    Filesize

    60KB

  • memory/3040-17-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/3040-24-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/3040-25-0x0000000008000000-0x000000000800F000-memory.dmp

    Filesize

    60KB