28cd81043f7ad4fbed9311521f3bc76c57c44e75e2dbc05b7b0f109363babb03

Analysis

max time kernel
3s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe
Size

73KB
MD5

7688ca8f750159fd834b8c5dc423205d
SHA1

1a3ec3460296e1ade68db3b8eabe01a1b9db6b28
SHA256

28cd81043f7ad4fbed9311521f3bc76c57c44e75e2dbc05b7b0f109363babb03
SHA512

07321a8de2062db9a6b415ba384ef735744d39561a3cf9732bf70a13e7f0ab7eba7e72f8942349f7ca15f72ef205d233bb54860f58070d8987a44991c5584e79
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJ3K0:ZVxkGOtEvwDpjcaz

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1484	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3340 wrote to memory of 1484	3340	2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe	28
PID 3340 wrote to memory of 1484	3340	2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe	28
PID 3340 wrote to memory of 1484	3340	2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_7688ca8f750159fd834b8c5dc423205d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3340
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
73KB

MD5
d62c1ca03d440fc906bdb3289371a5f9

SHA1
a45b591d6473d591eaeaf77d9bea496b5c64b6d6

SHA256
caa866b01733597bbced284bc150cb90add9fb8456bc2eb291dadb7430911859

SHA512
b0ae297c7f2322f2ae561b54e9a6a9a466b14a443c427590097f718a5236f443c59e70cb9abdf7bfce701d45b0768895558927f66f1b151ce9e89c8bbfe22868

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
9c1bb45005abc9c4867a761018882348

SHA1
8e5b8d0b75801566c6e2e6eaae45efddfcd2fa92

SHA256
816172fc91b9a5f31a74d760c1861ad8aea4cfcb219b20f58ae98e514c3088d8

SHA512
bcc5b63398cbeaea33676b7bd95ec65fd95da44993db9f10bad888be83d45441b4362d23cfd5212b537dfe12e7a175818fff107a1b9adeb6711ef51b83443695

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
32KB

MD5
ec938184ee6919f71ae86714937576b2

SHA1
ebaa4cbd9eefda13f10047dc4f718ea1a8c26fab

SHA256
860d8ef893fbd802c94982fc8693042b5942ccceb22445f4636e40c8044be6ca

SHA512
a6050d6a8d6ae43011f94d0111100a2cb4e60c571dc540e9d0eb2d119f39cf9b8d7d2cadf2e76d2e8ac6f5bcc26fe74d8584131064c9d6f74a0973fad0cef3e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
315B

MD5
a34ac19f4afae63adc5d2f7bc970c07f

SHA1
a82190fc530c265aa40a045c21770d967f4767b8

SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Download Submit
memory/1484-19-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/1484-20-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/1484-21-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/3340-2-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/3340-3-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/3340-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/3340-0-0x0000000000410000-0x0000000000413000-memory.dmp

Filesize
12KB

Download
memory/3340-17-0x0000000000410000-0x0000000000413000-memory.dmp

Filesize
12KB

Download