44755ecc736dc068d712388a28cc962d2416ad69ba9a5291f8ad44d1a4daa1b0

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23-05-2024 02:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe
Size

33KB
MD5

4835275efe7d6a1c433b4dc5ab7a3636
SHA1

ba1362861bc7184dab7e21c2d59b1cf295bca118
SHA256

44755ecc736dc068d712388a28cc962d2416ad69ba9a5291f8ad44d1a4daa1b0
SHA512

0ed12a41f7ff6382ea250ec8f419321349eec2457d5a4a54932005d4aa37d032ebea2224932891defa07d46ae877323f0b7bafb313c6eb67901d4b58eb789ecc
SSDEEP

768:bFPm5zusFUB2preAr+Ofjg0S16avdrQFiLjJvtXm:bFPmpiif/oc+vXm

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-1-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\lossy.exe	CryptoLocker_rule2
behavioral1/memory/2868-13-0x0000000000660000-0x000000000066E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2868-16-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1572-26-0x0000000008000000-0x000000000800E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2868-1-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
\Users\Admin\AppData\Local\Temp\lossy.exe	UPX
behavioral1/memory/2868-13-0x0000000000660000-0x000000000066E000-memory.dmp	UPX
behavioral1/memory/2868-16-0x0000000008000000-0x000000000800E000-memory.dmp	UPX
behavioral1/memory/1572-26-0x0000000008000000-0x000000000800E000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

Processes:

lossy.exe

pid process

1572 lossy.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe

pid process

2868 2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe

pid	process
1572	lossy.exe

pid	process
2868	2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/2868-1-0x0000000008000000-0x000000000800E000-memory.dmp	upx
\Users\Admin\AppData\Local\Temp\lossy.exe	upx
behavioral1/memory/2868-13-0x0000000000660000-0x000000000066E000-memory.dmp	upx
behavioral1/memory/2868-16-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral1/memory/1572-26-0x0000000008000000-0x000000000800E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe

description	pid	process	target process
PID 2868 wrote to memory of 1572	2868	2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe	lossy.exe
PID 2868 wrote to memory of 1572	2868	2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe	lossy.exe
PID 2868 wrote to memory of 1572	2868	2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe	lossy.exe
PID 2868 wrote to memory of 1572	2868	2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe	lossy.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_4835275efe7d6a1c433b4dc5ab7a3636_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2868

C:\Users\Admin\AppData\Local\Temp\lossy.exe
"C:\Users\Admin\AppData\Local\Temp\lossy.exe"
2⤵
- Executes dropped EXE
PID:1572

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe
Filesize
34KB

MD5
c0113c06714918ab7ef287efef3131d9

SHA1
d2d5cb18ab6e49dec9f5b5187e17b5797219d867

SHA256
c4295efc81a917eb51c91fac2323493c75a120cfb17f4d04251247572a3e50ee

SHA512
3f50e69c32e45d0337d7867547c04f26e884a2e22e2311fe185e4e8d1ab4933e889e8fed0da6d19683db9de0997c3e52d2096b3a6e3aa6364707b71e51f99c88

Download Submit
memory/1572-26-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2868-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2868-1-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/2868-2-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2868-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2868-13-0x0000000000660000-0x000000000066E000-memory.dmp

Filesize
56KB

Download
memory/2868-16-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download