Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
21-05-2024 16:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe
-
Size
42KB
-
MD5
a78b50cd1d9750a75015ad8508b76181
-
SHA1
378b4e5c9fbf24f56101d2cacfc83ed4687cfe5d
-
SHA256
a6c4e10524b7bb1a482ae3925796b310b0b40ee452e2a58faf46e8cdd2171354
-
SHA512
424cb5d6750da507b6c429b2d19909d8412a75611a68b352917af3c9b091f65eb96385516f2c966951fd11e9e6f52effd336fae3d84500320495878fa4153c0f
-
SSDEEP
768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAj:bCDOw9aMDooc+vAj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
Processes:
resource yara_rule behavioral2/memory/1920-0-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 C:\Users\Admin\AppData\Local\Temp\lossy.exe CryptoLocker_rule2 behavioral2/memory/1920-17-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 behavioral2/memory/1316-26-0x0000000008000000-0x000000000800A000-memory.dmp CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation 2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe -
Executes dropped EXE 1 IoCs
Processes:
lossy.exepid process 1316 lossy.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exedescription pid process target process PID 1920 wrote to memory of 1316 1920 2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe lossy.exe PID 1920 wrote to memory of 1316 1920 2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe lossy.exe PID 1920 wrote to memory of 1316 1920 2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe lossy.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_a78b50cd1d9750a75015ad8508b76181_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\lossy.exe"C:\Users\Admin\AppData\Local\Temp\lossy.exe"2⤵
- Executes dropped EXE
PID:1316
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD556dc024954941d09ed2537f9cdd841e3
SHA136219c855abe1c183d992f95b1d242ab9bf61765
SHA256930ba8eccaaa4119728e61b95d2829a0e874c8a02a519892a5e705f38d5bc665
SHA512e8ce6548b94910c274e38af41a89d2ecdcd9d29308544ea428611474430595244eec8967a8e242eb99d58dd156eecf1d4e137bec0e0bcc4e88c2ef58c5d21245