777000f1c6f85cd2ba1f90e06fd7ccb4f70f016108aac32408fad0abce26fb5e

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 05:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe
Size

52KB
MD5

8b6cb060b06788034e71e0ba51d74b0d
SHA1

64fa09c25d589b5d90ae848afa9a5518d454deca
SHA256

777000f1c6f85cd2ba1f90e06fd7ccb4f70f016108aac32408fad0abce26fb5e
SHA512

04f03f5d5dacd3a4be29bf1f5b940d217419690a8c747f131ffec7ec71a22ff122bcd1c1fe7f0f484e2e23315a7446b50ab6aac33b5ef226c15778511cd9fc06
SSDEEP

768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtOp:bODOw9acifAoc+vu

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2264-0-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\lossy.exe	CryptoLocker_rule2
behavioral2/memory/2264-16-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4016-18-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4016-27-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2264-0-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
C:\Users\Admin\AppData\Local\Temp\lossy.exe	UPX
behavioral2/memory/2264-16-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
behavioral2/memory/4016-18-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
behavioral2/memory/4016-27-0x0000000008000000-0x000000000800F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

lossy.exe

pid process

4016 lossy.exe

pid	process
4016	lossy.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/2264-0-0x0000000008000000-0x000000000800F000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\lossy.exe	upx
behavioral2/memory/2264-16-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral2/memory/4016-18-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral2/memory/4016-27-0x0000000008000000-0x000000000800F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe

description	pid	process	target process
PID 2264 wrote to memory of 4016	2264	2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe	lossy.exe
PID 2264 wrote to memory of 4016	2264	2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe	lossy.exe
PID 2264 wrote to memory of 4016	2264	2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe	lossy.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-25_8b6cb060b06788034e71e0ba51d74b0d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2264

C:\Users\Admin\AppData\Local\Temp\lossy.exe
"C:\Users\Admin\AppData\Local\Temp\lossy.exe"
2⤵
- Executes dropped EXE
PID:4016

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe
Filesize
52KB

MD5
6bab0dc1a446e181cece61f98defb20c

SHA1
1c7497cef7924080f95b8efced438c83bcc047fa

SHA256
0e6cbcffe361d2a91242d823cb6ae9cf37bf105e007907f35c451d7e992bbaed

SHA512
a901fc8cbb243c38800d0743a52f4d3e5052b29c6f93282f723dc38af2d167e67f3d18aceef2abf9da54365b4c2c08cc23117e2a027029d21ca50966bc67b767

Download Submit
memory/2264-0-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/2264-1-0x0000000002130000-0x0000000002136000-memory.dmp

Filesize
24KB

Download
memory/2264-2-0x0000000002030000-0x0000000002036000-memory.dmp

Filesize
24KB

Download
memory/2264-9-0x0000000002130000-0x0000000002136000-memory.dmp

Filesize
24KB

Download
memory/2264-16-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/4016-18-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/4016-26-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/4016-20-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/4016-27-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download