97013f2b3f725393844c617dc2fc82d6701fde7134f5c9e913faa68ace603b5c

Analysis

max time kernel
141s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
22/01/2024, 20:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-22_a86efb57451e90650026731d06fda140_cryptolocker.exe
Size

125KB
MD5

a86efb57451e90650026731d06fda140
SHA1

2de0591bb5e43f5cd4ab7fcfc9ddd016bc4c6bc8
SHA256

97013f2b3f725393844c617dc2fc82d6701fde7134f5c9e913faa68ace603b5c
SHA512

c40f6f79a0850b1138c8863a7064a4741155c592ac8e4a00ef993978b19bb227d5688c050488fb509cd9c664673d05a27be2f1d029efc552780868cb6ec5cdd8
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//W:vCjsIOtEvwDpj5H9YvQd2RU

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fa-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231fa-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	2024-01-22_a86efb57451e90650026731d06fda140_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
3964	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 3964	1828	2024-01-22_a86efb57451e90650026731d06fda140_cryptolocker.exe	87
PID 1828 wrote to memory of 3964	1828	2024-01-22_a86efb57451e90650026731d06fda140_cryptolocker.exe	87
PID 1828 wrote to memory of 3964	1828	2024-01-22_a86efb57451e90650026731d06fda140_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-01-22_a86efb57451e90650026731d06fda140_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-22_a86efb57451e90650026731d06fda140_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
125KB

MD5
78fa74a71425aad1f8f7537f8e382822

SHA1
8709424e11a73bf14223ec31edd38b9bf8da366d

SHA256
a8254530814df1e3b871313ae44a257739c904dc5a476b72e18a428a4aa9d4fa

SHA512
375e8a96d27b00dc072035f7c6d032bd0454df36a8b3276f833192faac197cbb4b26efc8da2855d2265705d2dc28067a90fbef0abaa4c8457696cf5e49432572

Download Submit
memory/1828-0-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1828-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1828-2-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/3964-18-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download