40770bc91fc915a4c3fa9408ce27a80be8954c6b1773274154272ca082f89194

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
25/05/2024, 22:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_876e5dd1b256d541f730cd485ef9d943_cryptolocker.exe
Size

56KB
MD5

876e5dd1b256d541f730cd485ef9d943
SHA1

7d97541d80857b4ff2c970cc984c1978d78f4296
SHA256

40770bc91fc915a4c3fa9408ce27a80be8954c6b1773274154272ca082f89194
SHA512

3d3cf9560cdefb310aaa9868e480951b3f04c9d4aea9536dedf5315f0ead18d96a54526e82b306b2996050f552e47bfa95eb5037ad3fb64936cddd12882ed539
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK9XbTb8pu1B:bIDOw9a0DwitDZzcTL1B

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000b000000023385-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2024-05-25_876e5dd1b256d541f730cd485ef9d943_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2256	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2508 wrote to memory of 2256	2508	2024-05-25_876e5dd1b256d541f730cd485ef9d943_cryptolocker.exe	83
PID 2508 wrote to memory of 2256	2508	2024-05-25_876e5dd1b256d541f730cd485ef9d943_cryptolocker.exe	83
PID 2508 wrote to memory of 2256	2508	2024-05-25_876e5dd1b256d541f730cd485ef9d943_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-25_876e5dd1b256d541f730cd485ef9d943_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_876e5dd1b256d541f730cd485ef9d943_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2508
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2256

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
56KB

MD5
f10117a297e034913153015e54595884

SHA1
1a12cdd63a2bd3ccb5e49e8c33b539b8226fbbea

SHA256
ee57c5181dd28eb3c11680a50f3fb744a5cb5da00c9b452ed9c909e952f34587

SHA512
58ae8004b25af769a8baa4f265eb6f89e04633f46e928c93b43223e3cd2e1e4db1bfb19e986a229658f84e465b996083f1e1534c7b26d3c02316c450090cd606

Download Submit
memory/2508-0-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/2508-2-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download
memory/2508-8-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download