8f3d0130bea1c325b902921b10f7ac2ac45482686bb551c5534df5e616e260a4

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 04:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe
Size

50KB
MD5

b52d1d132be56a2a8bd725a9d519517b
SHA1

503a88f5a91878ba808252468c6a6bd251285872
SHA256

8f3d0130bea1c325b902921b10f7ac2ac45482686bb551c5534df5e616e260a4
SHA512

de4c8406135d658e066511a8ac1128bd2d7f5f51f9be6b06e80ec2252c3d1e706aa6afcc8c22a669dfd982f61171912fd23253200e227375ec532e3d46e9494d
SSDEEP

768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtX:bODOw9acifAoc+vX

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/4368-0-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0008000000023405-13.dat	CryptoLocker_rule2
behavioral2/memory/776-17-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4368-19-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/776-27-0x0000000008000000-0x000000000800F000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 5 IoCs

resource	yara_rule
behavioral2/memory/4368-0-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
behavioral2/files/0x0008000000023405-13.dat	UPX
behavioral2/memory/776-17-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
behavioral2/memory/4368-19-0x0000000008000000-0x000000000800F000-memory.dmp	UPX
behavioral2/memory/776-27-0x0000000008000000-0x000000000800F000-memory.dmp	UPX

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
776	lossy.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4368-0-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral2/files/0x0008000000023405-13.dat	upx
behavioral2/memory/776-17-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral2/memory/4368-19-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral2/memory/776-27-0x0000000008000000-0x000000000800F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 776	4368	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe	84
PID 4368 wrote to memory of 776	4368	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe	84
PID 4368 wrote to memory of 776	4368	2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_b52d1d132be56a2a8bd725a9d519517b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
51KB

MD5
1ec7f374d6b63ea261708dd188742d60

SHA1
ce5658db3630ab4c4d7748d752a396a7dbc02c2d

SHA256
fb42ca8d0d9aca51b939f420b21c30e1ff248b1196d9cde5b476c4861ea02186

SHA512
ba124b22c5432c54f748d9203affd1ec5ce8b08b991d3a6f8bcdec9e4ea448a0759bacfee94026ef54b4b791eb023bf5737b17f446f232188b86046421f15be5

Download Submit
memory/776-17-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/776-26-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/776-20-0x0000000000740000-0x0000000000746000-memory.dmp

Filesize
24KB

Download
memory/776-27-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/4368-0-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/4368-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4368-2-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/4368-9-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4368-19-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download