325564231101bd6c31bce01c3a1f7d5804ac2b6da0a062eef34a94902775158a

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 05:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-15_3394368b6c2fa629885cc2e6c5fd3954_cryptolocker.exe
Size

41KB
MD5

3394368b6c2fa629885cc2e6c5fd3954
SHA1

9313800290df548fd184da1837504235a827db74
SHA256

325564231101bd6c31bce01c3a1f7d5804ac2b6da0a062eef34a94902775158a
SHA512

a3ee26cd7ec4ab2559b9bdd58ccd467249a8fbdf546198cde119def339f8d222a2e1264aca80a9621e0bd81dcd187b55d94bcb8ea77252b9144d71fc1edec73b
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAyj:bCDOw9aMDooc+vAyj

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4680-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x001c00000001e97e-13.dat	CryptoLocker_rule2
behavioral2/memory/4680-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2132-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	2024-04-15_3394368b6c2fa629885cc2e6c5fd3954_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2132	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 2132	4680	2024-04-15_3394368b6c2fa629885cc2e6c5fd3954_cryptolocker.exe	86
PID 4680 wrote to memory of 2132	4680	2024-04-15_3394368b6c2fa629885cc2e6c5fd3954_cryptolocker.exe	86
PID 4680 wrote to memory of 2132	4680	2024-04-15_3394368b6c2fa629885cc2e6c5fd3954_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-15_3394368b6c2fa629885cc2e6c5fd3954_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_3394368b6c2fa629885cc2e6c5fd3954_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
41KB

MD5
6f8c35c0a16e50f03d7add7e5477f013

SHA1
bbfeed0ceb4a35eeef0a1c4a372dc198280ebab0

SHA256
4075ffb7e5d0e019dc0671a0a66a7d855220b01076a8021fb4e0c4bd2d819274

SHA512
49bac7b3e6ccee5d329e6ff2c0b7f9582a0a27fe4bdf22e90e527d1f1c7a977f40a9a34ea29f554eed42218e668c0e9cfb15a426b71248b8108289870bd34558

Download Submit
memory/2132-19-0x0000000001FE0000-0x0000000001FE6000-memory.dmp

Filesize
24KB

Download
memory/2132-25-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

Filesize
24KB

Download
memory/2132-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4680-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/4680-1-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download
memory/4680-2-0x0000000002270000-0x0000000002276000-memory.dmp

Filesize
24KB

Download
memory/4680-3-0x0000000002170000-0x0000000002176000-memory.dmp

Filesize
24KB

Download
memory/4680-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download