5750b71d67ffd544f0842e79b698dfc063d89fcf97c291822ced9aee414beb86

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-02_877a56b49c1fc9995f84456265785787_cryptolocker.exe
Size

28KB
MD5

877a56b49c1fc9995f84456265785787
SHA1

6453381b07e835534db3994b48f7e6b7c4edb73a
SHA256

5750b71d67ffd544f0842e79b698dfc063d89fcf97c291822ced9aee414beb86
SHA512

09222530c9ca3007b9ff4e604c6a60d080a89b8ed5ce26ab56e57dee7f4f72f404d1210c326202ccfe1f3ca825d16100807dc7c1a8df39fb8676d006f1b64de0
SSDEEP

384:bFgFQrdSmuQ8WFqxpj5cpyIuYxVe3FSr+OLfjDp+0g/HNblX7QCOBqO:bFgm5zusFUB2preAr+Ofjg0STX73OBqO

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	2024-10-02_877a56b49c1fc9995f84456265785787_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3484	lossy.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3352-0-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral2/files/0x000800000002346b-12.dat	upx
behavioral2/memory/3352-17-0x0000000008000000-0x000000000800E000-memory.dmp	upx
behavioral2/memory/3484-26-0x0000000008000000-0x000000000800E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-02_877a56b49c1fc9995f84456265785787_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 3484	3352	2024-10-02_877a56b49c1fc9995f84456265785787_cryptolocker.exe	82
PID 3352 wrote to memory of 3484	3352	2024-10-02_877a56b49c1fc9995f84456265785787_cryptolocker.exe	82
PID 3352 wrote to memory of 3484	3352	2024-10-02_877a56b49c1fc9995f84456265785787_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-02_877a56b49c1fc9995f84456265785787_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-02_877a56b49c1fc9995f84456265785787_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
28KB

MD5
e2738aeb821674dd43fa6e84570935d0

SHA1
2b726752feed4b4c86d97b1da9475bc10e33abc5

SHA256
7aee15cfbc3bfe51814f06652afc1e5901b779cbbb04a2071bca07e708b37b70

SHA512
6b43626bcb623a21f2976add76be99ebe0bd548cdac78e7bb71d26951e2c3b2b5ef689dc1c82d8a306ddf4ab8a28bb7610e35796a0fc395861916c029b5be2cd

Download Submit
memory/3352-0-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/3352-1-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/3352-2-0x00007FFE247D0000-0x00007FFE249C5000-memory.dmp

Filesize
2.0MB

Download
memory/3352-3-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/3352-17-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/3484-25-0x00007FFE247D0000-0x00007FFE249C5000-memory.dmp

Filesize
2.0MB

Download
memory/3484-19-0x0000000001FE0000-0x0000000001FE6000-memory.dmp

Filesize
24KB

Download
memory/3484-26-0x0000000008000000-0x000000000800E000-memory.dmp

Filesize
56KB

Download
memory/3484-28-0x00007FFE247D0000-0x00007FFE249C5000-memory.dmp

Filesize
2.0MB

Download