Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    11/06/2024, 01:14

General

  • Target

    2024-06-11_cd41dad994ae88ad27fe9d660eea357f_cryptolocker.exe

  • Size

    53KB

  • MD5

    cd41dad994ae88ad27fe9d660eea357f

  • SHA1

    76fa2dfe5c015f1aefeb0bf66280d09e5c79116b

  • SHA256

    f8ee28eaf6a1172c9d7ce6bab74af535f67cbea04df9e99807acebe94b54fee4

  • SHA512

    8ae1a167adac502754a5377e3320a07127df9f04a0e7d37eb2191753a2634db212715b3e80d5516bb3306d8f19049cf0b2a4b0428b535cc8a31a925a3500341c

  • SSDEEP

    768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtOXy:bODOw9acifAoc+vt

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • UPX dump on OEP (original entry point) 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_cd41dad994ae88ad27fe9d660eea357f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_cd41dad994ae88ad27fe9d660eea357f_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:2868
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:1572

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\lossy.exe

          Filesize

          54KB

          MD5

          3f702b0cfdbb92521a24cf064923a12e

          SHA1

          f544076102e958490b32942a5f88e129d8edefb9

          SHA256

          644ea7282ac982e4d5e2a332e6f29677533a1691c3a2be8ca90512cf0d155996

          SHA512

          a029f0268b85e0b736ce29c1e3f805264679b35adbd59dadee4fc559aa9c751d9ab0a2968e561500ad2a6f7bb7a2400f1de6cf7f8785a1fdb429ab3b15680f78

        • memory/1572-17-0x0000000000310000-0x0000000000316000-memory.dmp

          Filesize

          24KB

        • memory/1572-24-0x00000000002C0000-0x00000000002C6000-memory.dmp

          Filesize

          24KB

        • memory/1572-25-0x0000000008000000-0x000000000800F000-memory.dmp

          Filesize

          60KB

        • memory/2868-0-0x0000000008000000-0x000000000800F000-memory.dmp

          Filesize

          60KB

        • memory/2868-1-0x0000000000320000-0x0000000000326000-memory.dmp

          Filesize

          24KB

        • memory/2868-2-0x0000000001C90000-0x0000000001C96000-memory.dmp

          Filesize

          24KB

        • memory/2868-9-0x0000000000320000-0x0000000000326000-memory.dmp

          Filesize

          24KB

        • memory/2868-14-0x0000000008000000-0x000000000800F000-memory.dmp

          Filesize

          60KB