Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-01-2024 17:38

General

  • Target

    2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe

  • Size

    39KB

  • MD5

    d4c650239bc932a6eb4b40430175ad77

  • SHA1

    85ae055d03c90df94cb4f665b95f151c5e9dd9a3

  • SHA256

    01106d5ec49f56920729252a625cb7787347acb63963b2c52efb07375962d9fa

  • SHA512

    5e6a506b2a9e4b0a21dd17e7e2e5abb29f6e01f5920874c86bd4b88b083e5aaf54b88f57299b8396e41054f712860d07e7853e7da17125d920989be815e14ac8

  • SSDEEP

    768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6Dy8POKm:bIDOw9a0Dwo3P1ojvUSDh4

Score
10/10

Malware Config

Signatures

  • Kinsing

    Kinsing is a loader written in Golang.

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-01-25_d4c650239bc932a6eb4b40430175ad77_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:412
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:4800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    39KB

    MD5

    e0e09e420f9741109fe214abe645e81e

    SHA1

    f5fe3cbcde0ae485ef8aeef7f898e24d046ec44c

    SHA256

    fb27a51a078b152fa7089b17e629716db103e8371f95ce618d3dbe1b30c7ce1a

    SHA512

    d8507a96717a9961bd0d587a3be5c661975605b4abad5af0f32250bf84fe904ee69600ca21248d4c909f7033e8678948690835989271704625ed89ed02247cec

  • memory/412-0-0x0000000002300000-0x0000000002306000-memory.dmp

    Filesize

    24KB

  • memory/412-1-0x0000000002300000-0x0000000002306000-memory.dmp

    Filesize

    24KB

  • memory/412-2-0x0000000002180000-0x0000000002186000-memory.dmp

    Filesize

    24KB

  • memory/4800-17-0x00000000006C0000-0x00000000006C6000-memory.dmp

    Filesize

    24KB

  • memory/4800-20-0x00000000006A0000-0x00000000006A6000-memory.dmp

    Filesize

    24KB