66a7e9f59ecab05b3d9d43d72c150ee8e137c211cadde459b9626a372a470a3e

Analysis

max time kernel
150s
max time network
150s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13/10/2024, 07:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe
Size

42KB
MD5

33bfc4d6d803a20cd7a98e3895bd37c2
SHA1

d53859a154a56917e9b61bb54694367a2b2b0b74
SHA256

66a7e9f59ecab05b3d9d43d72c150ee8e137c211cadde459b9626a372a470a3e
SHA512

2937cdb3f65424a7e156d06e646c1ad947efd80da55e727cca9287184ed92d2e25ba2e70c3f97f3847530ece033e2065ed4bd27a49374b85c76a07919852ed21
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAqt9:bCDOw9aMDooc+vAqt9

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
352	lossy.exe

Loads dropped DLL 1 IoCs

pid	Process
2816	2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 352	2816	2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe	31
PID 2816 wrote to memory of 352	2816	2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe	31
PID 2816 wrote to memory of 352	2816	2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe	31
PID 2816 wrote to memory of 352	2816	2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_33bfc4d6d803a20cd7a98e3895bd37c2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
43KB

MD5
024d5e27ab54c8f9c1b98abc801a9095

SHA1
8c240cbac8dec0173e7c45a50c72cf61ec56b5bc

SHA256
6f3c9644eb1cc1d04ca55b0d838e9836a5eedced46e82221ede8497b3609918d

SHA512
8b82680a5e52779b9a49ef98f67c467bebe26074a143e8aa36f358a2accf47cdb27dfbca467d8358a691f79a256c8edfb42529e7a8a07b669ba623b96c544ade

Download Submit
memory/352-17-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/352-24-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2816-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2816-1-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2816-9-0x0000000000320000-0x0000000000326000-memory.dmp

Filesize
24KB

Download
memory/2816-2-0x0000000000460000-0x0000000000466000-memory.dmp

Filesize
24KB

Download
memory/2816-15-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download