6777c5aee02f72b2506fe110437b0a476cbd68e586ad91b466752cafe82f1934

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-19_7e8b3b70fca60ea88f47f46602acec13_cryptolocker.exe
Size

48KB
MD5

7e8b3b70fca60ea88f47f46602acec13
SHA1

4efb22b6526f81afca3dd139e44cb67606d49031
SHA256

6777c5aee02f72b2506fe110437b0a476cbd68e586ad91b466752cafe82f1934
SHA512

e7fec1dfe34fddf45b8c01a4b9071eb56316186a53d4a129b6d37a83fe79c2d9dd12c5931725de158d4f114f88666a7f451a332b86ec357546274c30d92f06c6
SSDEEP

768:bIDOw9UiaCHfjnE0Sfa7ilR0p9u6p4ICNBCXK8tV:bIDOw9a0DwitDZz/tV

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	2024-09-19_7e8b3b70fca60ea88f47f46602acec13_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1012	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-19_7e8b3b70fca60ea88f47f46602acec13_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 1012	2144	2024-09-19_7e8b3b70fca60ea88f47f46602acec13_cryptolocker.exe	82
PID 2144 wrote to memory of 1012	2144	2024-09-19_7e8b3b70fca60ea88f47f46602acec13_cryptolocker.exe	82
PID 2144 wrote to memory of 1012	2144	2024-09-19_7e8b3b70fca60ea88f47f46602acec13_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-09-19_7e8b3b70fca60ea88f47f46602acec13_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_7e8b3b70fca60ea88f47f46602acec13_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
48KB

MD5
f3552330929e3bbf2a5c4373776de54e

SHA1
f27cdd544ff0eb56b559984655dd55b80eef4d4e

SHA256
416c07812f07767d34a6dd56f46afe0139b1c83b6cda9140dd6adcbfa985b34d

SHA512
b6ea342a6af25c04187bb8bb5894fed508c5f5498b47bd35c7bcdd72857d03bd10e7b752873623f46b7c2ca60868a08c6249ad59c43a3d5899c5b09cee73e2b1

Download Submit
memory/1012-17-0x0000000000580000-0x0000000000586000-memory.dmp

Filesize
24KB

Download
memory/1012-18-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/2144-0-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download
memory/2144-1-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download
memory/2144-2-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download