Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/06/2024, 07:46

General

  • Target

    2024-06-03_d03269204fcc1b0762bdbe04ef5707fa_cryptolocker.exe

  • Size

    5.5MB

  • MD5

    d03269204fcc1b0762bdbe04ef5707fa

  • SHA1

    3a9e2fbe0baf8a007cce5add773d03f61e0a488b

  • SHA256

    a26cf784cff73f77ec876a046f29721f4e15c24d818d98e1ffbd6fb749b05af3

  • SHA512

    7a40a072f9c6e17ece7d61940696256c8f3f5e8ac732d38d718db60419edf0e46ab0c1f5c61e35c86985f393b2f6b32397e19ef20985f5410d5fed70b77e93be

  • SSDEEP

    98304:ot1QKvyjzO6B3DenIMmzyxD++XsBq+JUieGNt3sB/a1Ed9m+UfJ:otTvgz73XMpxDbcwYvt3sFa4OJ

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 9 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-03_d03269204fcc1b0762bdbe04ef5707fa_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-03_d03269204fcc1b0762bdbe04ef5707fa_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2308
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1476

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    5.5MB

    MD5

    d3d6ab48cdf45035cbad9e7945d9ad40

    SHA1

    a1e61f8d289a5d7ddc149b06d6bba398142558b0

    SHA256

    219cc6ddef34a3803d8e54eeb1cd20af561cf5b48e6c237b79145a6287b95fdb

    SHA512

    1bf38d56755cfc1dabd1a34c68011b9b3b3fd6b65ed61f5da59f80bb4a3f3ac9c8c2f4c7ac32e138e6ff1f0a5941f6c08284d81b34b605f5452cd8e7cc89a1f3

  • memory/1476-25-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/1476-23-0x0000000000520000-0x0000000000521000-memory.dmp

    Filesize

    4KB

  • memory/1476-33-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/1476-27-0x0000000001F70000-0x0000000001F76000-memory.dmp

    Filesize

    24KB

  • memory/1476-24-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2308-6-0x0000000000500000-0x0000000000506000-memory.dmp

    Filesize

    24KB

  • memory/2308-3-0x000000000800A000-0x0000000008303000-memory.dmp

    Filesize

    3.0MB

  • memory/2308-5-0x00000000004E0000-0x00000000004E6000-memory.dmp

    Filesize

    24KB

  • memory/2308-13-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2308-22-0x000000000800A000-0x0000000008303000-memory.dmp

    Filesize

    3.0MB

  • memory/2308-1-0x0000000000490000-0x0000000000491000-memory.dmp

    Filesize

    4KB

  • memory/2308-0-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2308-21-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2308-4-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB

  • memory/2308-2-0x0000000008000000-0x0000000008884000-memory.dmp

    Filesize

    8.5MB