8f3d0130bea1c325b902921b10f7ac2ac45482686bb551c5534df5e616e260a4

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
30/05/2024, 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe
Size

50KB
MD5

b52d1d132be56a2a8bd725a9d519517b
SHA1

503a88f5a91878ba808252468c6a6bd251285872
SHA256

8f3d0130bea1c325b902921b10f7ac2ac45482686bb551c5534df5e616e260a4
SHA512

de4c8406135d658e066511a8ac1128bd2d7f5f51f9be6b06e80ec2252c3d1e706aa6afcc8c22a669dfd982f61171912fd23253200e227375ec532e3d46e9494d
SSDEEP

768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtX:bODOw9acifAoc+vX

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral1/memory/1632-0-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x00090000000120ff-11.dat	CryptoLocker_rule2
behavioral1/memory/1632-14-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1708-16-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/1708-26-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral1/memory/1632-0-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
behavioral1/files/0x00090000000120ff-11.dat	UPX
behavioral1/memory/1632-14-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
behavioral1/memory/1708-16-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
behavioral1/memory/1708-26-0x0000000008000000-0x000000000800F000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1708	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
1632	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1632-0-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral1/files/0x00090000000120ff-11.dat	upx
behavioral1/memory/1632-14-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral1/memory/1708-16-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral1/memory/1708-26-0x0000000008000000-0x000000000800F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1708	1632	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe	28
PID 1632 wrote to memory of 1708	1632	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe	28
PID 1632 wrote to memory of 1708	1632	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe	28
PID 1632 wrote to memory of 1708	1632	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:1708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
51KB

MD5
1ec7f374d6b63ea261708dd188742d60

SHA1
ce5658db3630ab4c4d7748d752a396a7dbc02c2d

SHA256
fb42ca8d0d9aca51b939f420b21c30e1ff248b1196d9cde5b476c4861ea02186

SHA512
ba124b22c5432c54f748d9203affd1ec5ce8b08b991d3a6f8bcdec9e4ea448a0759bacfee94026ef54b4b791eb023bf5737b17f446f232188b86046421f15be5

Download Submit
memory/1632-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1632-0-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/1632-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1632-2-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1632-14-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/1708-16-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/1708-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1708-25-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/1708-26-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download