f7432d5636e4d5febe687f8cc634d73f02fca1f7232c2b8ffe1bd921e231d0a2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
26-04-2024 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-26_29d046dd0185409897b0f2e806a654c3_cryptolocker.exe
Size

41KB
MD5

29d046dd0185409897b0f2e806a654c3
SHA1

b0247c35352205bd5f61d8a3c5393dd2147a8f46
SHA256

f7432d5636e4d5febe687f8cc634d73f02fca1f7232c2b8ffe1bd921e231d0a2
SHA512

31e7ab8ad08695c7b2fa4619a7ece7bf958605492932f944a474e68b726e46455954e5d385b83f5faa3e55b6c4d07822ef3f081160f67373056e24a57c43e257
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAXq:bCDOw9aMDooc+vAXq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/528-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000300000001e970-13.dat	CryptoLocker_rule2
behavioral2/memory/528-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2324-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	2024-04-26_29d046dd0185409897b0f2e806a654c3_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2324	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 528 wrote to memory of 2324	528	2024-04-26_29d046dd0185409897b0f2e806a654c3_cryptolocker.exe	86
PID 528 wrote to memory of 2324	528	2024-04-26_29d046dd0185409897b0f2e806a654c3_cryptolocker.exe	86
PID 528 wrote to memory of 2324	528	2024-04-26_29d046dd0185409897b0f2e806a654c3_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-26_29d046dd0185409897b0f2e806a654c3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-26_29d046dd0185409897b0f2e806a654c3_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:528
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
41KB

MD5
1231463a661b538dabd4c4d1677ce4f6

SHA1
7b7b646d71f5d7f7ad103df27bf8432cd487131f

SHA256
edda2feac8f71686349681ff9ca0ecc822d30007506b27a1485c2431afcf6445

SHA512
47e5a4ddf03961ac07421e315c47c79dec0de805db6a1bb8cd939932d73fc4155dbb4e745ffe9d750719904f448dc14004c3351255f6de6d03180e95c162c54d

Download Submit
memory/528-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/528-1-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/528-2-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/528-3-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/528-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2324-19-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/2324-25-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/2324-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download