5afa2de06788f1684b2c2f831060c928dd91bb6bad0daa17673f25993beff66e

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 05:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-04_4c6d4580bc283f7a01431be31a87c98c_cryptolocker.exe
Size

44KB
MD5

4c6d4580bc283f7a01431be31a87c98c
SHA1

b32149dabe842dff6ad7b25681d6445559a9f342
SHA256

5afa2de06788f1684b2c2f831060c928dd91bb6bad0daa17673f25993beff66e
SHA512

61f269c51c6c16b040a27c1e4239a4a6ded6affb33125accf0300976e2503962aadf8842fba151289298c3b1dce5de43b04c2c90a82bb6ac295dc618640e2fa5
SSDEEP

768:bCDOw9UiaKHfjnD0S16avdrQFiLjJvtAqjrHL:bCDOw9aMDooc+vAqjLL

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	2024-10-04_4c6d4580bc283f7a01431be31a87c98c_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2228	lossy.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-04_4c6d4580bc283f7a01431be31a87c98c_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2228	2996	2024-10-04_4c6d4580bc283f7a01431be31a87c98c_cryptolocker.exe	82
PID 2996 wrote to memory of 2228	2996	2024-10-04_4c6d4580bc283f7a01431be31a87c98c_cryptolocker.exe	82
PID 2996 wrote to memory of 2228	2996	2024-10-04_4c6d4580bc283f7a01431be31a87c98c_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-10-04_4c6d4580bc283f7a01431be31a87c98c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-04_4c6d4580bc283f7a01431be31a87c98c_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
44KB

MD5
8e019a288f65557d7b01dd136c7ca69c

SHA1
500ec170a5259c817ea6be401743c105feec06a3

SHA256
c35e9406ea6c60d701837be3e0bc625b71968708ca422a5bea0c48da5eef259f

SHA512
8ca0c0f0a90276d31275f40e9d4ed9c4c8d5084ce0422e9e185afa65adbf3d27bb31d58a2fb8642d49366385d0b394895ee9c850306d226d725561c8de831de6

Download Submit
memory/2228-19-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/2228-25-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/2228-26-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2996-0-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download
memory/2996-1-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download
memory/2996-2-0x00000000021F0000-0x00000000021F6000-memory.dmp

Filesize
24KB

Download
memory/2996-3-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/2996-17-0x0000000008000000-0x000000000800A000-memory.dmp

Filesize
40KB

Download