Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 18:35
Behavioral task
behavioral1
Sample
2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe
Resource
win7-20240729-en
General
-
Target
2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe
-
Size
28KB
-
MD5
740feb469d72935369e8298b3d484808
-
SHA1
f8dbc595b56580b13f1399158b44dce5d303aeee
-
SHA256
1b19cfbdbfa9989f583446d22ffc13e808ea0010cac83e9ad0d021a8b124c62b
-
SHA512
1e351eaafb926d413497176cfb1083d400d953934235bbe93adce1706995b6ef848b9c657144e8a219c89a1999bc6087d9b2823552ac9a451d31c56443467e23
-
SSDEEP
384:bFgFQrdSmuQ8WFqxpj5cpyIuYxVe3FSr+OLfjDp+0g/HNblX7QCOBqYr:bFgm5zusFUB2preAr+Ofjg0STX73OBqc
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2988 lossy.exe -
Loads dropped DLL 1 IoCs
pid Process 1884 2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe -
resource yara_rule behavioral1/memory/1884-7-0x0000000008000000-0x000000000800E000-memory.dmp upx behavioral1/memory/1884-15-0x0000000008000000-0x000000000800E000-memory.dmp upx behavioral1/memory/2988-17-0x0000000008000000-0x000000000800E000-memory.dmp upx behavioral1/files/0x000b0000000122cf-16.dat upx behavioral1/memory/2988-26-0x0000000008000000-0x000000000800E000-memory.dmp upx -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language lossy.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1884 wrote to memory of 2988 1884 2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe 30 PID 1884 wrote to memory of 2988 1884 2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe 30 PID 1884 wrote to memory of 2988 1884 2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe 30 PID 1884 wrote to memory of 2988 1884 2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2988
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
28KB
MD52d57c7453451f8bfbe028bdc77d88c63
SHA1e96fe821afa00be8c59e636734256e6187af4f47
SHA2561355218c1ab668ad4f676be82e51f51a6d4ff1190a2c6ce4730024e7ad28ee12
SHA5124a606ee2a03c98bcd31a09b3793ba744056f9789b9d9df563e8d77063cb74647b088d3a0f9aeb1028fa9a637a67beec5b8db80aa8215ece9b899960e41701afb