9fb2b08efe636e4252acd65b78ba0afeef127498b2112ca9ea68fdcfb134253b

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 17:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_b3ce61c5965c314de46995725c21b8a9_cryptolocker.exe
Size

50KB
MD5

b3ce61c5965c314de46995725c21b8a9
SHA1

eb5a9efd73d816e8cd636068c019eb856b229430
SHA256

9fb2b08efe636e4252acd65b78ba0afeef127498b2112ca9ea68fdcfb134253b
SHA512

b46726babfacd3ebfe7214b0d1201863aeec6531fd6722aa15116553b4054c4f24127c1bc10d6686280fb20a0a37831cef3505570c2de059f0f0707b228cc1ff
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPxyV4tFVgQDM:bIDOw9a0Dwo3P1ojvUSD4PRtFVgt

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001e5eb-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	2024-03-06_b3ce61c5965c314de46995725c21b8a9_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1516	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 1516	4288	2024-03-06_b3ce61c5965c314de46995725c21b8a9_cryptolocker.exe	89
PID 4288 wrote to memory of 1516	4288	2024-03-06_b3ce61c5965c314de46995725c21b8a9_cryptolocker.exe	89
PID 4288 wrote to memory of 1516	4288	2024-03-06_b3ce61c5965c314de46995725c21b8a9_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-06_b3ce61c5965c314de46995725c21b8a9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_b3ce61c5965c314de46995725c21b8a9_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:1516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
51KB

MD5
303f8e2727a8cd7ab6cf8a13ad8b4bf4

SHA1
9380a02d042165694b46c34ce0357f93e06b1bf5

SHA256
33a537bd333db68e26736434c33711ca885a1229237fc44a78426f95295b1b1d

SHA512
2461aa1e6d2a20a455298475db4afc2a6978a03ce761557d8dfcf2c313c4670e879d36d13d9df73afdfe57b31515b75ffe95b7eb816563d37c32a0f3d51d480f

Download Submit
memory/1516-17-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/1516-19-0x00000000020C0000-0x00000000020C6000-memory.dmp

Filesize
24KB

Download
memory/4288-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4288-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4288-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download