455a45518914ff2a8bb5726c821fb656279a2a57297187f54d6d88fc1bcb6348

Analysis

max time kernel
150s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15/09/2024, 02:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-15_2a5ae30c0dd1f0a1b1721c75d6dd7c3f_cryptolocker.exe
Size

49KB
MD5

2a5ae30c0dd1f0a1b1721c75d6dd7c3f
SHA1

be116eb70e074bd3d9dcebf95b2c0a2892ddc2fa
SHA256

455a45518914ff2a8bb5726c821fb656279a2a57297187f54d6d88fc1bcb6348
SHA512

07c308dbb4512822ce4557f28ca125c347b1188f2b92ee218505282050853770c6e510e54aad6aec3600268a20eef6e683d0c9938a55cefc0aaa552acd0d541a
SSDEEP

768:bIDOw9UiaCHfjnE0Sf88AvvP1oghYvm9/6D8jnPx9UnuDLlD+wj:bIDOw9a0Dwo3P1ojvUSD4PInyD5

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	2024-09-15_2a5ae30c0dd1f0a1b1721c75d6dd7c3f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2272	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-15_2a5ae30c0dd1f0a1b1721c75d6dd7c3f_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 2272	3076	2024-09-15_2a5ae30c0dd1f0a1b1721c75d6dd7c3f_cryptolocker.exe	91
PID 3076 wrote to memory of 2272	3076	2024-09-15_2a5ae30c0dd1f0a1b1721c75d6dd7c3f_cryptolocker.exe	91
PID 3076 wrote to memory of 2272	3076	2024-09-15_2a5ae30c0dd1f0a1b1721c75d6dd7c3f_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-09-15_2a5ae30c0dd1f0a1b1721c75d6dd7c3f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-15_2a5ae30c0dd1f0a1b1721c75d6dd7c3f_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=3836,i,11391966286255097843,10588851088187498028,262144 --variations-seed-version --mojo-platform-channel-handle=3948 /prefetch:8
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
49KB

MD5
972f9437f5efd3bd1c781da7cf8228f5

SHA1
2cd464f3c3085e603bb29ab31283b85c0577c98b

SHA256
928926adeb3a92b7b7e2c1776519bc92bc81614162995088d2d3d6df533ac58c

SHA512
736db47d0ea2052372f633fcf05b88b7524b4200ac869ed4f0e3921c70b271d369b5467e34cacf3036cd061c37f61bb9d5126f0a4e72a19bb90399e219fdd639

Download Submit
memory/2272-17-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/2272-18-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download
memory/3076-0-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/3076-1-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/3076-2-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download