e803f0d950be2d4b2520b28af50005b9f43305b7a28a92edb4f3ae1dd914c56e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-04_5a320fa50e03c659fa0ae5319b55c96d_cryptolocker.exe
Size

44KB
MD5

5a320fa50e03c659fa0ae5319b55c96d
SHA1

539e9050c7c40086e9b904772a33d18e1a281fa0
SHA256

e803f0d950be2d4b2520b28af50005b9f43305b7a28a92edb4f3ae1dd914c56e
SHA512

a204a43468ef168c36ffa787d8b17d52b57488b5771fe18691561de00079158e1b7f7f8a900685fbf59ad516b893e46e3efafe384810a508c6caddad9ccf3347
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAHtJ:bCDOw9aMDooc+vANJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/1404-0-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0009000000023297-13.dat	CryptoLocker_rule2
behavioral2/memory/1404-17-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2688-18-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2688-26-0x0000000008000000-0x000000000800A000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	2024-06-04_5a320fa50e03c659fa0ae5319b55c96d_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2688	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2688	1404	2024-06-04_5a320fa50e03c659fa0ae5319b55c96d_cryptolocker.exe	82
PID 1404 wrote to memory of 2688	1404	2024-06-04_5a320fa50e03c659fa0ae5319b55c96d_cryptolocker.exe	82
PID 1404 wrote to memory of 2688	1404	2024-06-04_5a320fa50e03c659fa0ae5319b55c96d_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-04_5a320fa50e03c659fa0ae5319b55c96d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-04_5a320fa50e03c659fa0ae5319b55c96d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
44KB

MD5
067a7c8583dce2b20e223573b8480164

SHA1
c5ac39c9dffdd31895b65e8898cf34f064c27ed8

SHA256
1686191cce469ff15dbe121dabb0fa392f6b731e48b65486681b36831044b340

SHA512
478de5cd0d2da8941572f8c07af9aa2cac30f6e3becbb4774028f73b425cdb7ddfcc988c2ca1bf198666161a43f57190a77d263fb5ee678f1622c98c7a17a307

Download Submit
memory/1404-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/1404-1-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/1404-2-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/1404-3-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/1404-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2688-18-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2688-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2688-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download