b163b8fa47e875db4600bedc4d305f586d54ee5d74ce82451a70820403f93947

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 02:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-10_6b28d3e861eaf92a7b5fff17550986eb_cryptolocker.exe
Size

46KB
MD5

6b28d3e861eaf92a7b5fff17550986eb
SHA1

f31b8d4839cc5427c2f1eddc7555f20af87b6cd0
SHA256

b163b8fa47e875db4600bedc4d305f586d54ee5d74ce82451a70820403f93947
SHA512

bb78f73ad292558bf78e6c6f6ded45d9d01deb1ec09dd087b1c6f8436bfbeb4796c7fae5dcfa5309f2814d65aefa5025128fe9810b9882eec5793cf19ea5ecc2
SSDEEP

768:bODOw9UiamWUB2preAr+OfjH/0STX73OBqO6:bODOw9acifH+Yt

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	2024-10-10_6b28d3e861eaf92a7b5fff17550986eb_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2672	lossy.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2040-0-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral2/files/0x000a000000023c98-13.dat	upx
behavioral2/memory/2040-18-0x0000000008000000-0x000000000800F000-memory.dmp	upx
behavioral2/memory/2672-26-0x0000000008000000-0x000000000800F000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-10_6b28d3e861eaf92a7b5fff17550986eb_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	lossy.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2672	2040	2024-10-10_6b28d3e861eaf92a7b5fff17550986eb_cryptolocker.exe	84
PID 2040 wrote to memory of 2672	2040	2024-10-10_6b28d3e861eaf92a7b5fff17550986eb_cryptolocker.exe	84
PID 2040 wrote to memory of 2672	2040	2024-10-10_6b28d3e861eaf92a7b5fff17550986eb_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-10-10_6b28d3e861eaf92a7b5fff17550986eb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-10_6b28d3e861eaf92a7b5fff17550986eb_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\lossy.exe
  "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\lossy.exe

Filesize
47KB

MD5
8796f9886a593a387336cb66afbccc2c

SHA1
2b1feee37115b9a9a1ef26060fee2dfa74a77b3b

SHA256
e3eba71fcf265a2ca7bb374bd4ce8b6838e29cb4adba92b50b5648f3f96856c0

SHA512
31448ab2cc8a3a5e0357a22933227797feb3d24f090f199368d61f76762cdbbaee84479f2050237f2f53b2cd5236568fd33036fa354143c95b1bf1cb47272e99

Download Submit
memory/2040-0-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/2040-1-0x0000000002140000-0x0000000002146000-memory.dmp

Filesize
24KB

Download
memory/2040-2-0x0000000002140000-0x0000000002146000-memory.dmp

Filesize
24KB

Download
memory/2040-3-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/2040-18-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download
memory/2672-19-0x0000000001F60000-0x0000000001F66000-memory.dmp

Filesize
24KB

Download
memory/2672-25-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/2672-26-0x0000000008000000-0x000000000800F000-memory.dmp

Filesize
60KB

Download