Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 01:14

General

  • Target

    2024-06-11_cd41dad994ae88ad27fe9d660eea357f_cryptolocker.exe

  • Size

    53KB

  • MD5

    cd41dad994ae88ad27fe9d660eea357f

  • SHA1

    76fa2dfe5c015f1aefeb0bf66280d09e5c79116b

  • SHA256

    f8ee28eaf6a1172c9d7ce6bab74af535f67cbea04df9e99807acebe94b54fee4

  • SHA512

    8ae1a167adac502754a5377e3320a07127df9f04a0e7d37eb2191753a2634db212715b3e80d5516bb3306d8f19049cf0b2a4b0428b535cc8a31a925a3500341c

  • SSDEEP

    768:bODOw9UiamWUB2preAr+OfjH/0S16avdrQFiLjJvtOXy:bODOw9acifAoc+vt

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_cd41dad994ae88ad27fe9d660eea357f_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_cd41dad994ae88ad27fe9d660eea357f_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:5016
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Executes dropped EXE
      PID:3680

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\lossy.exe

          Filesize

          54KB

          MD5

          3f702b0cfdbb92521a24cf064923a12e

          SHA1

          f544076102e958490b32942a5f88e129d8edefb9

          SHA256

          644ea7282ac982e4d5e2a332e6f29677533a1691c3a2be8ca90512cf0d155996

          SHA512

          a029f0268b85e0b736ce29c1e3f805264679b35adbd59dadee4fc559aa9c751d9ab0a2968e561500ad2a6f7bb7a2400f1de6cf7f8785a1fdb429ab3b15680f78

        • memory/3680-18-0x0000000008000000-0x000000000800F000-memory.dmp

          Filesize

          60KB

        • memory/3680-20-0x0000000000660000-0x0000000000666000-memory.dmp

          Filesize

          24KB

        • memory/3680-26-0x0000000000640000-0x0000000000646000-memory.dmp

          Filesize

          24KB

        • memory/3680-27-0x0000000008000000-0x000000000800F000-memory.dmp

          Filesize

          60KB

        • memory/5016-0-0x0000000008000000-0x000000000800F000-memory.dmp

          Filesize

          60KB

        • memory/5016-1-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

          Filesize

          24KB

        • memory/5016-2-0x0000000001FE0000-0x0000000001FE6000-memory.dmp

          Filesize

          24KB

        • memory/5016-9-0x0000000001FC0000-0x0000000001FC6000-memory.dmp

          Filesize

          24KB

        • memory/5016-17-0x0000000008000000-0x000000000800F000-memory.dmp

          Filesize

          60KB