72a3918bd256b6f3ffd0a67991b047a227b910b7e3e501f8698479daf28c6d70

Analysis

max time kernel
151s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 09:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_fdc31d5e0a309c65d547ed5da048e542_cryptolocker.exe
Size

51KB
MD5

fdc31d5e0a309c65d547ed5da048e542
SHA1

3c16ff64301bdba2d6c892ab1f6784e5c52be665
SHA256

72a3918bd256b6f3ffd0a67991b047a227b910b7e3e501f8698479daf28c6d70
SHA512

33e742c8d52d4dc0074e6961aa621b12e64335689328979a9f84f9a82da46c8d4028deb21167ef81ca13cd072425a97162f5b1db43d8fd539cff16080cf8077f
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9Xv+mb6uX8:bIDOw9a0DwitDZzc16J

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023115-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	2024-02-24_fdc31d5e0a309c65d547ed5da048e542_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1260	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3780 wrote to memory of 1260	3780	2024-02-24_fdc31d5e0a309c65d547ed5da048e542_cryptolocker.exe	86
PID 3780 wrote to memory of 1260	3780	2024-02-24_fdc31d5e0a309c65d547ed5da048e542_cryptolocker.exe	86
PID 3780 wrote to memory of 1260	3780	2024-02-24_fdc31d5e0a309c65d547ed5da048e542_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-24_fdc31d5e0a309c65d547ed5da048e542_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_fdc31d5e0a309c65d547ed5da048e542_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3780
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
51KB

MD5
4d6fbb34aa5e24c5fa15f8338d0f8ee1

SHA1
14d9210eec02212ea358ff4c5209d0e9ab5d36a7

SHA256
6b74363f46bb0ea622771044bbc8f22d92d06d2ca473abb7f317946a5054835e

SHA512
f596a396305c563f34917fa0647c370fbf42cd32fe28d8f6d00281b6e7e534cedc03ab35e7976004cac341cace2a3af894748d2bead8a93929f31b089f531cfe

Download Submit
memory/1260-17-0x0000000002030000-0x0000000002036000-memory.dmp

Filesize
24KB

Download
memory/1260-19-0x0000000002140000-0x0000000002146000-memory.dmp

Filesize
24KB

Download
memory/3780-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3780-1-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/3780-2-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download