2e38090be6e80f03940b4934441e11b3d832c6ab2a3c6bde1d7985bd20d199f6

Analysis

max time kernel
88s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 15:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-22_ab8478168620e2c11c5b7675badb5ffe_cryptolocker.exe
Size

47KB
MD5

ab8478168620e2c11c5b7675badb5ffe
SHA1

252cf8da2ada7ea64fd8f52d7fdf0151b6ead9ff
SHA256

2e38090be6e80f03940b4934441e11b3d832c6ab2a3c6bde1d7985bd20d199f6
SHA512

f5deb7d833418ad2763c49ffb2c6d36ef5aebeb331fa48e01124e18b0857fb06396787cab3acfdea91f84e039fa8a4ee4d67ae147cffa86e66d0bfff2983a238
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLtldfHWPO:xj+VGMOtEvwDpjk/fHYO

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/3056-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x00080000000231f7-13.dat	CryptoLocker_rule2
behavioral2/memory/3056-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3852-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3852-53-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral2/memory/3056-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x00080000000231f7-13.dat	CryptoLocker_set1
behavioral2/memory/3056-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3852-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3852-53-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/3056-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x00080000000231f7-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3056-17-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3852-18-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3852-53-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	misid.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-01-22_ab8478168620e2c11c5b7675badb5ffe_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3852	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 3852	3056	2024-01-22_ab8478168620e2c11c5b7675badb5ffe_cryptolocker.exe	87
PID 3056 wrote to memory of 3852	3056	2024-01-22_ab8478168620e2c11c5b7675badb5ffe_cryptolocker.exe	87
PID 3056 wrote to memory of 3852	3056	2024-01-22_ab8478168620e2c11c5b7675badb5ffe_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-22_ab8478168620e2c11c5b7675badb5ffe_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-22_ab8478168620e2c11c5b7675badb5ffe_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
b3f5ee7763abc3ffa375bc0e35488dec

SHA1
1b3b16820a0eeb9269411e654805dc914b6dc556

SHA256
6f33accf977a95e46fc82bfc3bd128f47eab7324e6202c6861f8885961b225b2

SHA512
81640053b796a39237c8df14511daa2da98bbb25625ad02f3aaef8d013d69e3a4673cd9199124269760460ed49fe6272a49d65ffd7cafc5d5063168018b477ff

Download Submit
memory/3056-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3056-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/3056-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/3056-3-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/3056-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3852-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3852-20-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/3852-26-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3852-53-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download