2c7d9b78cef31dad96ec65666a37945dbd9744048f73427205e062d293405595

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
29/04/2024, 20:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-29_ecf79c57a91046b3ee4910305f0ba4b4_cryptolocker.exe
Size

41KB
MD5

ecf79c57a91046b3ee4910305f0ba4b4
SHA1

582188c89043909e16d500c992f813ab8b79874a
SHA256

2c7d9b78cef31dad96ec65666a37945dbd9744048f73427205e062d293405595
SHA512

f98f01d070713c3fbe3a535bbd022d20b63028fe3c78b91fff3993c78dff62745875012790e1b68a8b103d9806e8074297c0cbae80b616a1741b82f5b0cb8d7e
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6DyE9x3pO:bIDOw9a0Dwo3P1ojvUSD79RpO

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b4c-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	2024-04-29_ecf79c57a91046b3ee4910305f0ba4b4_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1848	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4464 wrote to memory of 1848	4464	2024-04-29_ecf79c57a91046b3ee4910305f0ba4b4_cryptolocker.exe	84
PID 4464 wrote to memory of 1848	4464	2024-04-29_ecf79c57a91046b3ee4910305f0ba4b4_cryptolocker.exe	84
PID 4464 wrote to memory of 1848	4464	2024-04-29_ecf79c57a91046b3ee4910305f0ba4b4_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-04-29_ecf79c57a91046b3ee4910305f0ba4b4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_ecf79c57a91046b3ee4910305f0ba4b4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4464
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:1848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
41KB

MD5
31c7e672dd4f3cbe268236229dbcc7a5

SHA1
aeaa4682c4e4cde48caf3aebe38ba0af00ab7bf2

SHA256
e66f72efa6120447f0c8471923373d77359e935e5f4a0966f60db02e1934e93d

SHA512
cbf5f60afaada0d41b3958088f20eee996eff0834c104f8e6bd6c1fc12f23d40ed0d7a470bdf92a00083c6dea7ab9ccac482d109f7c91623499b2723a15f8fc7

Download Submit
memory/1848-17-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/1848-23-0x0000000002140000-0x0000000002146000-memory.dmp

Filesize
24KB

Download
memory/4464-0-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/4464-5-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4464-8-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download