Analysis

  • max time kernel
    23s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10/06/2024, 06:29

General

  • Target

    2024-06-10_cd67531cb1e6243c47259271d3ba3b7c_cryptolocker.exe

  • Size

    44KB

  • MD5

    cd67531cb1e6243c47259271d3ba3b7c

  • SHA1

    802aab317ce9c1b53fcffd0eca77f3813087df49

  • SHA256

    f5cc4a283c19383da15c1a5a43c45d7b715394b56e54454cd12befce707e4d42

  • SHA512

    376f1d5f52065a1919e43e90f7988312a2f5af92ca9882a6bbc88a03629f4b232f78f04248810b6897233021ed1f76c976345652ec81be7063ed5aa94d2cf74b

  • SSDEEP

    768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAHLT:bCDOw9aMDooc+vArT

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-10_cd67531cb1e6243c47259271d3ba3b7c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-10_cd67531cb1e6243c47259271d3ba3b7c_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:848
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3932

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\lossy.exe

          Filesize

          44KB

          MD5

          9f401f7505a756fa839a34ab484bdc38

          SHA1

          e0143ab34c918f9c6a7b8defeec3d75c403d01bd

          SHA256

          4a4e45c1de9c7725a25e5d76531cab26d850fb40936a786d574d82fd62e55d20

          SHA512

          ed274148d18309e4e60310b9d9d887662db9bee2d66e76c0cd092710b4a9ae9a89d5b0d0e45d7cb0c50ccf51c83e5650413567d007ffaac412357e59ecf73fa8

        • memory/848-0-0x0000000008000000-0x000000000800A000-memory.dmp

          Filesize

          40KB

        • memory/848-3-0x00000000020E0000-0x00000000020E6000-memory.dmp

          Filesize

          24KB

        • memory/848-2-0x00000000020C0000-0x00000000020C6000-memory.dmp

          Filesize

          24KB

        • memory/848-17-0x0000000008000000-0x000000000800A000-memory.dmp

          Filesize

          40KB

        • memory/848-1-0x00000000020C0000-0x00000000020C6000-memory.dmp

          Filesize

          24KB

        • memory/3932-26-0x00000000021B0000-0x00000000021B6000-memory.dmp

          Filesize

          24KB

        • memory/3932-20-0x00000000020D0000-0x00000000020D6000-memory.dmp

          Filesize

          24KB

        • memory/3932-18-0x0000000008000000-0x000000000800A000-memory.dmp

          Filesize

          40KB

        • memory/3932-27-0x0000000008000000-0x000000000800A000-memory.dmp

          Filesize

          40KB