4854c6d52db692a643eeb2a2858e03865ed26eb5a2c6f751b85b0b3b3e5cc680

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 02:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe
Size

43KB
MD5

8d0fa4bd663de56f9d1b42bf21c9544a
SHA1

34a88b8e582d3f97f3987eee0b38bf14e00782b7
SHA256

4854c6d52db692a643eeb2a2858e03865ed26eb5a2c6f751b85b0b3b3e5cc680
SHA512

d0e8e9bd13577f4e4423a1dfc52c881449b94af61fdea610f23381eca42eb529dd208af7671b6922089ebb78308b7d308346b62d016ffeaa72414870d70d2dd8
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAqjrd:bCDOw9aMDooc+vAqjB

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2740	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
664	2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 2740	664	2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe	29
PID 664 wrote to memory of 2740	664	2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe	29
PID 664 wrote to memory of 2740	664	2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe	29
PID 664 wrote to memory of 2740	664	2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-13_8d0fa4bd663de56f9d1b42bf21c9544a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
43KB

MD5
6e821a7760f2a0c30765364bc8e0592a

SHA1
962928be279f4b0fdf72e726762d77e4ecfc32d5

SHA256
a6b0205a59696c8099c91e835b067a4aa411bd7f0e62bd3d41a76adddc785cff

SHA512
229b1c7725cf4b3a48ba3cf540ee365c0ec25ca083b28e77d50d3fc6ab4feb7d1bb57d02cc445f96baa73481deca9f1a0ce511a98cc775d13d295b837c06aa38

Download Submit
memory/664-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/664-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/664-9-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/664-1-0x0000000000240000-0x0000000000246000-memory.dmp

Filesize
24KB

Download
memory/664-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2740-16-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2740-18-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/2740-25-0x00000000002B0000-0x00000000002B6000-memory.dmp

Filesize
24KB

Download
memory/2740-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download