6e50bc60402c576d2f48595c57c77b9b904bfdb4d4a1defa3d5006c93b0006a9

Analysis

max time kernel
149s
max time network
151s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05/07/2024, 19:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-07-05_ae2856ea50255268dc7290081d94d454_cryptolocker.exe
Size

52KB
MD5

ae2856ea50255268dc7290081d94d454
SHA1

b281705028c508f348726891668c08e6dbc68371
SHA256

6e50bc60402c576d2f48595c57c77b9b904bfdb4d4a1defa3d5006c93b0006a9
SHA512

00250fcd7425e0ddd6cca56195e7435b5480d8b9d7155fff0bc253b772ae4f35700c293fd23956735985c780b4fecd980751aaf92aed3e6f87297cd779f903f9
SSDEEP

768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtOd:bODOw9acifAoc+vC

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2816	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2120	2024-07-05_ae2856ea50255268dc7290081d94d454_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2120-8-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral1/files/0x000d000000012731-11.dat	upx
behavioral1/memory/2816-15-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral1/memory/2816-24-0x0000000008000000-0x000000000800F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 2816	2120	2024-07-05_ae2856ea50255268dc7290081d94d454_cryptolocker.exe	31
PID 2120 wrote to memory of 2816	2120	2024-07-05_ae2856ea50255268dc7290081d94d454_cryptolocker.exe	31
PID 2120 wrote to memory of 2816	2120	2024-07-05_ae2856ea50255268dc7290081d94d454_cryptolocker.exe	31
PID 2120 wrote to memory of 2816	2120	2024-07-05_ae2856ea50255268dc7290081d94d454_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-07-05_ae2856ea50255268dc7290081d94d454_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-07-05_ae2856ea50255268dc7290081d94d454_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
53KB

MD5
f295b15f89c50eef7caa1459a32921ff

SHA1
ba42734bcaa5274cd70fc3f4455a874747c4b7e9

SHA256
00e1e24bcd2d2aae17e36fea6ec0f452657d2057e311998b061a2e7994d927ff

SHA512
561d6dc2b7451dbb8b30c249181bf67b943b751bebbd53a0a43d3a1e1b363d06d59d9dfb51ae516accd40b8f0e7dc065bb31e2e4d765d2961c1fce091a4f8f45

Download Submit
memory/2120-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2120-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2120-8-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/2120-0-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/2816-15-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/2816-17-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/2816-24-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download