Analysis

  • max time kernel
    86s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 18:35

General

  • Target

    2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe

  • Size

    28KB

  • MD5

    740feb469d72935369e8298b3d484808

  • SHA1

    f8dbc595b56580b13f1399158b44dce5d303aeee

  • SHA256

    1b19cfbdbfa9989f583446d22ffc13e808ea0010cac83e9ad0d021a8b124c62b

  • SHA512

    1e351eaafb926d413497176cfb1083d400d953934235bbe93adce1706995b6ef848b9c657144e8a219c89a1999bc6087d9b2823552ac9a451d31c56443467e23

  • SSDEEP

    384:bFgFQrdSmuQ8WFqxpj5cpyIuYxVe3FSr+OLfjDp+0g/HNblX7QCOBqYr:bFgm5zusFUB2preAr+Ofjg0STX73OBqc

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-09_740feb469d72935369e8298b3d484808_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Users\Admin\AppData\Local\Temp\lossy.exe
      "C:\Users\Admin\AppData\Local\Temp\lossy.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:944

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\lossy.exe

    Filesize

    28KB

    MD5

    2d57c7453451f8bfbe028bdc77d88c63

    SHA1

    e96fe821afa00be8c59e636734256e6187af4f47

    SHA256

    1355218c1ab668ad4f676be82e51f51a6d4ff1190a2c6ce4730024e7ad28ee12

    SHA512

    4a606ee2a03c98bcd31a09b3793ba744056f9789b9d9df563e8d77063cb74647b088d3a0f9aeb1028fa9a637a67beec5b8db80aa8215ece9b899960e41701afb

  • C:\Users\Admin\AppData\Local\Temp\swenled.exe

    Filesize

    537B

    MD5

    590a2a16db7c9454e5429278e1e95347

    SHA1

    11dd68b8c510df635ff033c58fa002fdcd196927

    SHA256

    c5ffd9dbef8cebbf04436e0680847b95be3f8140e3b3d1e99fe7e743799dfd97

    SHA512

    7e55708920fe2541ab1236c7616d67fd85795e80bc5f399d9b101372c347534940f2f81d942bb094c2d188b23a3501439443afbc0ca142758708c909c009cfa3

  • memory/944-20-0x00000000005A0000-0x00000000005A6000-memory.dmp

    Filesize

    24KB

  • memory/944-21-0x00000000020F0000-0x00000000020F6000-memory.dmp

    Filesize

    24KB

  • memory/944-52-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/1200-0-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/1200-1-0x0000000002200000-0x0000000002206000-memory.dmp

    Filesize

    24KB

  • memory/1200-2-0x0000000002200000-0x0000000002206000-memory.dmp

    Filesize

    24KB

  • memory/1200-3-0x0000000002230000-0x0000000002236000-memory.dmp

    Filesize

    24KB

  • memory/1200-18-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB