748a4fbe8eaad61e35cccd6389e20bbe7503c78231b4473415db239876bd28d6

Analysis

max time kernel
0s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
04/01/2024, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-03_4c338ee257669bf8483b08fdc1218fb0_cryptolocker.exe
Size

87KB
MD5

4c338ee257669bf8483b08fdc1218fb0
SHA1

2f1c7410f85dfc1bee015b8e40637a6c9bd8c442
SHA256

748a4fbe8eaad61e35cccd6389e20bbe7503c78231b4473415db239876bd28d6
SHA512

658f572fb47ef50f3e883726e9c0493d4b7dc96b7e35d1bbd224a6dcb8f69981206a948916a41e98436984e9fe775b5a3bf8c9af3cd112c6a0259a02aed656b6
SSDEEP

1536:zj+soPSMOtEvwDpj4ktBl01hJl8QAPM8Ho6cRDjB:zCsanOtEvwDpjM

Score

7^/10

upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-03_4c338ee257669bf8483b08fdc1218fb0_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
528	misid.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1508-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000600000001e5df-13.dat	upx
behavioral2/memory/1508-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000600000001e5df-16.dat	upx
behavioral2/files/0x000600000001e5df-15.dat	upx
behavioral2/memory/528-48-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1508 wrote to memory of 528	1508	2024-01-03_4c338ee257669bf8483b08fdc1218fb0_cryptolocker.exe	17
PID 1508 wrote to memory of 528	1508	2024-01-03_4c338ee257669bf8483b08fdc1218fb0_cryptolocker.exe	17
PID 1508 wrote to memory of 528	1508	2024-01-03_4c338ee257669bf8483b08fdc1218fb0_cryptolocker.exe	17

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
1⤵
- Executes dropped EXE
PID:528

C:\Users\Admin\AppData\Local\Temp\2024-01-03_4c338ee257669bf8483b08fdc1218fb0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-03_4c338ee257669bf8483b08fdc1218fb0_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
4423b40a11d71a40d65123b056f29032

SHA1
652122d34d501cc81ca1180614fe41cfdbbff3cf

SHA256
5224b5b38d1d2228b10aa9b0d6606fbaa71e20c880e22a1e9cbed90ec2666aa3

SHA512
b11ebe0c8d0caf9674e38ead88a4cb53ea0b704c9b8640d4163569983788fe98b9d9755f6631a79fd5119e7919bb0cdafe1c59e62647ba36931e33d4ce3d0351

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
f9b0183584608d852ee4d1210e5d48df

SHA1
b124e057b75e2892947b5a2acdd58967829dbe33

SHA256
ca9f19615f1e8c4f2d4b5dbb0678f4ab6cb5c2349ea6416032f71694a608813c

SHA512
5e65daa32133432903e8d5f13524d92edc635775aa483f8ba8f68f2a8e374d8e9b026752c1b868c500e1e2d1c11b9e3d73c720489b9c6326a93ac55e3f4c2746

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
1KB

MD5
dadd9442a6df5d87946543586e102a67

SHA1
efbfca8117824aa2c768f3dc46179852228da41c

SHA256
90fbde71642fddbc39e794b91f7826a7f63e9b91437c50e2ad5f8e445f13bed1

SHA512
d34dd912bdc525ee09a453cc5938a7f7f01633e61d6d9782b1a16b143e3f889703b564d08a73f884103a331356b68cd2d7390549ab6f52c54ed70ac2cebe292b

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
315B

MD5
a34ac19f4afae63adc5d2f7bc970c07f

SHA1
a82190fc530c265aa40a045c21770d967f4767b8

SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Download Submit
memory/528-25-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/528-19-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/528-48-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1508-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1508-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/1508-5-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1508-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1508-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download