f7b6bdc0a07940881a59ad71ade8ca9abe2d5bf9252d6e232f4939a43105f0f5

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
27-04-2024 22:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe
Size

54KB
MD5

01775a7cc02daeec95be36d5f2574129
SHA1

7c22a368771e137ab6406b9333f7dd4c5e13dad7
SHA256

f7b6bdc0a07940881a59ad71ade8ca9abe2d5bf9252d6e232f4939a43105f0f5
SHA512

1bd6bef2ede92742f65b425529dcbf00ce0f8a66fb7ba92d581c0420378b8457e39e875146bd63738e7e17a050c6a1012ae6928eb2b7f8cd9945ce568e398f61
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTb8pu6:bIDOw9a0DwitDZzcTL6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\lossy.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

lossy.exe

pid process

2252 lossy.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2252	lossy.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe

description	pid	process	target process
PID 116 wrote to memory of 2252	116	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe	lossy.exe
PID 116 wrote to memory of 2252	116	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe	lossy.exe
PID 116 wrote to memory of 2252	116	2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe	lossy.exe

C:\Users\Admin\AppData\Local\Temp\2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-27_01775a7cc02daeec95be36d5f2574129_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:116

C:\Users\Admin\AppData\Local\Temp\lossy.exe
"C:\Users\Admin\AppData\Local\Temp\lossy.exe"
2⤵
- Executes dropped EXE
PID:2252

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe
Filesize
54KB

MD5
9179a159c7ab094c609712bbc91c7d19

SHA1
57621de66819d9f42a4021f4389320f6b7dd13cf

SHA256
8cacff8cf748a18aae522f8a8cc287356194f4def38872f26f468c080b77bc08

SHA512
b486f5c1c9293a98b87ad0c171d642fe63defd6c53817270b5fc34bebad76396caada3d5c0cb3689a1fb04bc633c056208e2237395c58d56126ffaa94984af4d

Download Submit
memory/116-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/116-1-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/116-8-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/2252-17-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/2252-23-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download