Analysis

  • max time kernel
    72s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240215-en
  • resource tags

    arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
  • submitted
    10/06/2024, 06:29

General

  • Target

    2024-06-10_cd67531cb1e6243c47259271d3ba3b7c_cryptolocker.exe

  • Size

    44KB

  • MD5

    cd67531cb1e6243c47259271d3ba3b7c

  • SHA1

    802aab317ce9c1b53fcffd0eca77f3813087df49

  • SHA256

    f5cc4a283c19383da15c1a5a43c45d7b715394b56e54454cd12befce707e4d42

  • SHA512

    376f1d5f52065a1919e43e90f7988312a2f5af92ca9882a6bbc88a03629f4b232f78f04248810b6897233021ed1f76c976345652ec81be7063ed5aa94d2cf74b

  • SSDEEP

    768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAHLT:bCDOw9aMDooc+vArT

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 6 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-10_cd67531cb1e6243c47259271d3ba3b7c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-10_cd67531cb1e6243c47259271d3ba3b7c_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2748
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:2856

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\lossy.exe

          Filesize

          44KB

          MD5

          9f401f7505a756fa839a34ab484bdc38

          SHA1

          e0143ab34c918f9c6a7b8defeec3d75c403d01bd

          SHA256

          4a4e45c1de9c7725a25e5d76531cab26d850fb40936a786d574d82fd62e55d20

          SHA512

          ed274148d18309e4e60310b9d9d887662db9bee2d66e76c0cd092710b4a9ae9a89d5b0d0e45d7cb0c50ccf51c83e5650413567d007ffaac412357e59ecf73fa8

        • memory/2748-0-0x0000000008000000-0x000000000800A000-memory.dmp

          Filesize

          40KB

        • memory/2748-1-0x00000000001C0000-0x00000000001C6000-memory.dmp

          Filesize

          24KB

        • memory/2748-2-0x00000000003F0000-0x00000000003F6000-memory.dmp

          Filesize

          24KB

        • memory/2748-9-0x00000000001C0000-0x00000000001C6000-memory.dmp

          Filesize

          24KB

        • memory/2748-12-0x0000000002830000-0x000000000283A000-memory.dmp

          Filesize

          40KB

        • memory/2748-16-0x0000000008000000-0x000000000800A000-memory.dmp

          Filesize

          40KB

        • memory/2856-17-0x0000000008000000-0x000000000800A000-memory.dmp

          Filesize

          40KB

        • memory/2856-26-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/2856-19-0x0000000000380000-0x0000000000386000-memory.dmp

          Filesize

          24KB

        • memory/2856-27-0x0000000008000000-0x000000000800A000-memory.dmp

          Filesize

          40KB