b8cfa567249bb7d67ee08c6d72a8b9daa70d04f46395fd85e3d396fb50927059

Analysis

max time kernel
85s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_64325ce3db1878ccd0b0e098211cd25b_cryptolocker.exe
Size

51KB
MD5

64325ce3db1878ccd0b0e098211cd25b
SHA1

d823d1aa937b8d06bc78499a69f633b9ced52474
SHA256

b8cfa567249bb7d67ee08c6d72a8b9daa70d04f46395fd85e3d396fb50927059
SHA512

6867648a3f6c695bf7842b70a2bcb22b0e19ab14e9364241b9efa2d6998d956c0733f13b708bd4d1249e656daa6b726c44e12354b2539e3d4a9194dbf2c9ed16
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9GsA:bIDOw9a0DwitDZz2A

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231ed-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-01-25_64325ce3db1878ccd0b0e098211cd25b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3480	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3480	3412	2024-01-25_64325ce3db1878ccd0b0e098211cd25b_cryptolocker.exe	85
PID 3412 wrote to memory of 3480	3412	2024-01-25_64325ce3db1878ccd0b0e098211cd25b_cryptolocker.exe	85
PID 3412 wrote to memory of 3480	3412	2024-01-25_64325ce3db1878ccd0b0e098211cd25b_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-01-25_64325ce3db1878ccd0b0e098211cd25b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_64325ce3db1878ccd0b0e098211cd25b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:3480

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
52KB

MD5
c504927871f0d301a46640e78e1eea9f

SHA1
c67e3cb0e5e0802bc21ae2e022f71d5d38d14d72

SHA256
11ef5359d9e74f0b3dc1a4e21ae936606da2897d51e53752a09f6a0051a421e2

SHA512
2bc1d859b3ce75c6141e0683f235f5ecf5cec4b3d010610878ce6b5df70a3b34c125d3f378701fd060f9184681174bbf027e0a363ef865375c070892fd46794c

Download Submit
memory/3412-0-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/3412-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/3412-2-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3480-17-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/3480-19-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download