Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 18:35

General

  • Target

    2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe

  • Size

    28KB

  • MD5

    740feb469d72935369e8298b3d484808

  • SHA1

    f8dbc595b56580b13f1399158b44dce5d303aeee

  • SHA256

    1b19cfbdbfa9989f583446d22ffc13e808ea0010cac83e9ad0d021a8b124c62b

  • SHA512

    1e351eaafb926d413497176cfb1083d400d953934235bbe93adce1706995b6ef848b9c657144e8a219c89a1999bc6087d9b2823552ac9a451d31c56443467e23

  • SSDEEP

    384:bFgFQrdSmuQ8WFqxpj5cpyIuYxVe3FSr+OLfjDp+0g/HNblX7QCOBqYr:bFgm5zusFUB2preAr+Ofjg0STX73OBqc

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1884
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2988

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    28KB

    MD5

    2d57c7453451f8bfbe028bdc77d88c63

    SHA1

    e96fe821afa00be8c59e636734256e6187af4f47

    SHA256

    1355218c1ab668ad4f676be82e51f51a6d4ff1190a2c6ce4730024e7ad28ee12

    SHA512

    4a606ee2a03c98bcd31a09b3793ba744056f9789b9d9df563e8d77063cb74647b088d3a0f9aeb1028fa9a637a67beec5b8db80aa8215ece9b899960e41701afb

  • memory/1884-9-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/1884-7-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/1884-1-0x00000000003C0000-0x00000000003C6000-memory.dmp

    Filesize

    24KB

  • memory/1884-0-0x0000000000240000-0x0000000000246000-memory.dmp

    Filesize

    24KB

  • memory/1884-15-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/2988-17-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/2988-19-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB

  • memory/2988-26-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB