7f1d688dca06794f7bab7882a8f68fc1f5f362ef1d69a6dbf6c7ab38ccfa7eae

Analysis

max time kernel
2s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09/01/2024, 06:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-08_876a5aeaab6d4a22d31cd8ddd9261184_cryptolocker.exe
Size

78KB
MD5

876a5aeaab6d4a22d31cd8ddd9261184
SHA1

6064cbabecf5252e9b398dd0f6a184405ff0106b
SHA256

7f1d688dca06794f7bab7882a8f68fc1f5f362ef1d69a6dbf6c7ab38ccfa7eae
SHA512

43d6e965dcd713fde6c7b6d8c3b2b42a86ffd7b2c33978e1080bebf419679f87c170ff00b83ee88f934de77cf540710bf60fa39a17ccc36b6eaaf1856b31abf7
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMk:TCjsIOtEvwDpj5HE/OUHnSM2

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	2024-01-08_876a5aeaab6d4a22d31cd8ddd9261184_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4168	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4996 wrote to memory of 4168	4996	2024-01-08_876a5aeaab6d4a22d31cd8ddd9261184_cryptolocker.exe	44
PID 4996 wrote to memory of 4168	4996	2024-01-08_876a5aeaab6d4a22d31cd8ddd9261184_cryptolocker.exe	44
PID 4996 wrote to memory of 4168	4996	2024-01-08_876a5aeaab6d4a22d31cd8ddd9261184_cryptolocker.exe	44

C:\Users\Admin\AppData\Local\Temp\2024-01-08_876a5aeaab6d4a22d31cd8ddd9261184_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-08_876a5aeaab6d4a22d31cd8ddd9261184_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4996
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
64KB

MD5
8c491daa87822fb81dea982d0627fbf2

SHA1
06ab5e5367644a93ac9cef1588dd7e1676cce742

SHA256
80945f09fe59701f7bb4113ca7e25987f6717d91c1246f0e69582fef9b64c93a

SHA512
00886bed2fed791429b976321574b3dc62b418dc1ccb8895dd95c9ba625645afad1f5fba71acd2d0bf8a9d507c8ba1af7f18b6e8f8b73ee154364a340e35d3c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
13KB

MD5
e59372c3de2b65a06ae10da7dc714163

SHA1
09ea8ab841fe040f031f55deaefa1faa1f707cca

SHA256
d7b2b94acc8a57c529f77d26819d6bf4118bba06b4dd45571b03368a1d199c9b

SHA512
d5f56bfa24137775f4ad1c119eec2273bc85a87ced819820cbd5de4a528e2d471d8ba5f4a5abb3e2c67d9914fec877ef4f20f55683d0a8bbbe790b01065af2fa

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
32KB

MD5
d602bdac0d554f30b310b90e9a5f133e

SHA1
e07e941c7ea926ec3dc1d7ae33a9b244d07847a2

SHA256
8c7247bda5eed4e3ab161268095eb748f63a4ab63c53f9bf309fa6965a78ba1b

SHA512
5aab1c1ba6c1d8112fbe76716f1d0fccc44fdcd3c0c3ee547f6e507b338c5688a0243ad6acd713646e1ec61a9c428ddec8457bca3f280e23e506e74ec3079541

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
315B

MD5
a34ac19f4afae63adc5d2f7bc970c07f

SHA1
a82190fc530c265aa40a045c21770d967f4767b8

SHA256
d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

SHA512
42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

Download Submit
memory/4168-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4168-48-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4996-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4996-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4996-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4996-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4996-20-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download