360c35dbdf5978a9f4bbedebe7fc6ff3981aeaeed8e6198e8090b3c5fdd2d5e3

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 02:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe
Size

42KB
MD5

e35f547094c27d9007b195380764114a
SHA1

600df97c2adb396efef06fa4dfa0553b18d4ded8
SHA256

360c35dbdf5978a9f4bbedebe7fc6ff3981aeaeed8e6198e8090b3c5fdd2d5e3
SHA512

e5942706e6fed01300190f55b693bed7cf5368727744ae32adf5535a29dcb3869e876a4655c6d4ff6f3d1f6928396a95e84fca68014e4b06aa25b174939d4e9e
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAqt/:bCDOw9aMDooc+vAqt/

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1660	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
1668	2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1668 wrote to memory of 1660	1668	2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe	31
PID 1668 wrote to memory of 1660	1668	2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe	31
PID 1668 wrote to memory of 1660	1668	2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe	31
PID 1668 wrote to memory of 1660	1668	2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_e35f547094c27d9007b195380764114a_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1668
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
42KB

MD5
623c9764f9f1e5094a4aa30d12123a9d

SHA1
197b9bffba85b9d27cc965dc2a1cad4db0e25803

SHA256
0ddb0a8e03bcc88b27e31df6985c9ef0de0d60e8d056b05688040bc9276e9fbc

SHA512
b453ebf096f5b261afb29e00daa4b4ed2a06ec0981f3e9eda959902543cfc6967183bda5b90e503a9f001423987fec93dc4cb708012d52f11a913830bb79aec6

Download Submit
memory/1660-17-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/1660-24-0x0000000000250000-0x0000000000256000-memory.dmp

Filesize
24KB

Download
memory/1660-25-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1668-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1668-1-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1668-2-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/1668-9-0x00000000001D0000-0x00000000001D6000-memory.dmp

Filesize
24KB

Download
memory/1668-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download