546bda6543df8a066963f49ec85e50bdaf41d4c4bb41b71cb538626464406bf9

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
08/06/2024, 03:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-08_152b0b8f78c8918ec982723c195796c0_cryptolocker.exe
Size

50KB
MD5

152b0b8f78c8918ec982723c195796c0
SHA1

495cd1a90bf0ae4c3c7d2564d1f47c3fa28b8047
SHA256

546bda6543df8a066963f49ec85e50bdaf41d4c4bb41b71cb538626464406bf9
SHA512

4edf0333e617d363237995ed757f0bb6cf09a1252d7f856d0d6a92eac97c2ab7794ab5d9f37a306a110897d5d7e5b189d4220f7ac84a743dcd337e5d32bc9c03
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPx9UnuDLlD+IJr:bIDOw9a0Dwo3P1ojvUSD4PInyDJr

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001226d-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2584	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
1768	2024-06-08_152b0b8f78c8918ec982723c195796c0_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1768 wrote to memory of 2584	1768	2024-06-08_152b0b8f78c8918ec982723c195796c0_cryptolocker.exe	28
PID 1768 wrote to memory of 2584	1768	2024-06-08_152b0b8f78c8918ec982723c195796c0_cryptolocker.exe	28
PID 1768 wrote to memory of 2584	1768	2024-06-08_152b0b8f78c8918ec982723c195796c0_cryptolocker.exe	28
PID 1768 wrote to memory of 2584	1768	2024-06-08_152b0b8f78c8918ec982723c195796c0_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-08_152b0b8f78c8918ec982723c195796c0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-08_152b0b8f78c8918ec982723c195796c0_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1768
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
50KB

MD5
907a850a7c6933554cc1414474da1772

SHA1
c2cb1b3ae009f3de57f3b325e8dd970f8eaf5366

SHA256
92746c5c40313cb09398e2b5453329e247ec452e32d000fd50c837539d8394ba

SHA512
215f0926372bf849f4bc949a52ac2fbf09c2cd0f0b92a6aae3fa3df01cccc642df3472a68f3a2e2754009c794e03b8e7bad28949d017c8fb6367b7d703e0df62

Download Submit
memory/1768-0-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/1768-1-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/1768-8-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2584-15-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2584-22-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download