ee96a49e8181d38d005a65d936213b691dbf72af464ed0bf6b9636872c8e091c

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 00:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe
Size

55KB
MD5

2b90eba97762aa6b74886fa2e29f4924
SHA1

65ce748abe2fba17a25c742f9dab40ca9c532ed2
SHA256

ee96a49e8181d38d005a65d936213b691dbf72af464ed0bf6b9636872c8e091c
SHA512

b090c8e94ce8d3839e19acc564940179e8dd216c2dee62b3dc591095de3bcb9ae3f8cc0e65acdd1cbb8d82b001596f81fc395dcece302316c59b483f7855b519
SSDEEP

768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtOXMqY:bODOw9acifAoc+vUY

Score

7^/10

discovery upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2788	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
1792	2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1792-0-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral1/files/0x00080000000120fe-11.dat	upx
behavioral1/memory/1792-14-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral1/memory/2788-25-0x0000000008000000-0x000000000800F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2788	1792	2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe	30
PID 1792 wrote to memory of 2788	1792	2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe	30
PID 1792 wrote to memory of 2788	1792	2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe	30
PID 1792 wrote to memory of 2788	1792	2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-21_2b90eba97762aa6b74886fa2e29f4924_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2788

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
55KB

MD5
9e74e385dff11dcb33413faae9799362

SHA1
ef6f9214ab0a3c4dff6fbd7f85ce5695d1cac650

SHA256
5db8959955c8f08e5edfc10f50a08b959fed5f3639393808530726348d9ed453

SHA512
fcbb90833cca02c2f18742d803d019de8661efc2f5ebc0c33f57fcfc6c808c7e2fde5b917a546e9922b90dcbdcf6afcf35b069264fea045172630b65b4c24a07

Download Submit
memory/1792-0-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/1792-2-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download
memory/1792-9-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1792-1-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download
memory/1792-14-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/2788-17-0x0000000000310000-0x0000000000316000-memory.dmp

Filesize
24KB

Download
memory/2788-24-0x00000000002D0000-0x00000000002D6000-memory.dmp

Filesize
24KB

Download
memory/2788-25-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download