1978f7d23ae89fec47ff61fcd53f09b2f13d5a291f3070e45e67870bfd01049f

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
25/05/2024, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_7ea309fbb9e45167d24d0c93518d4f92_cryptolocker.exe
Size

42KB
MD5

7ea309fbb9e45167d24d0c93518d4f92
SHA1

8928d96c6ad429743ef4fb86cb1c16f2ad36c3a7
SHA256

1978f7d23ae89fec47ff61fcd53f09b2f13d5a291f3070e45e67870bfd01049f
SHA512

f4e1100ca0d89fe6c5bce7cd9c038b936b5d2c0ef0edb109b58519a3cda0a5805e7f0f2698649e979deecf520ff4cb60dc559357f92fcf9c66100bd7864aae0b
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAw:bCDOw9aMDooc+vAw

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2740-1-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000015cb0-11.dat	CryptoLocker_rule2
behavioral1/memory/2884-16-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2884-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2884	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2740	2024-05-25_7ea309fbb9e45167d24d0c93518d4f92_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2740 wrote to memory of 2884	2740	2024-05-25_7ea309fbb9e45167d24d0c93518d4f92_cryptolocker.exe	28
PID 2740 wrote to memory of 2884	2740	2024-05-25_7ea309fbb9e45167d24d0c93518d4f92_cryptolocker.exe	28
PID 2740 wrote to memory of 2884	2740	2024-05-25_7ea309fbb9e45167d24d0c93518d4f92_cryptolocker.exe	28
PID 2740 wrote to memory of 2884	2740	2024-05-25_7ea309fbb9e45167d24d0c93518d4f92_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-25_7ea309fbb9e45167d24d0c93518d4f92_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_7ea309fbb9e45167d24d0c93518d4f92_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
43KB

MD5
c47d2d544c4a990e7885214c184eaf7d

SHA1
80b8c33be68b7f718a63d6afd6835b820443bb4a

SHA256
fe3b7b0d787df88bc4768f58d1b998153ffde2ddaddd9dc2b72d9c6ae9506567

SHA512
36caac8b8239212a7b99d1d113b608a659a388e081e991b856259fd8d2e09f1ac8693d4c6ba6754bb8b8c83b466e1b6371570f3109d5b90d12d7fe75cdbc1fb4

Download Submit
memory/2740-0-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2740-2-0x0000000000440000-0x0000000000446000-memory.dmp

Filesize
24KB

Download
memory/2740-1-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2740-3-0x0000000000480000-0x0000000000486000-memory.dmp

Filesize
24KB

Download
memory/2740-13-0x0000000002160000-0x000000000216A000-memory.dmp

Filesize
40KB

Download
memory/2884-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2884-18-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2884-25-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/2884-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download