Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 15:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exe
-
Size
38KB
-
MD5
a06cd550705e95523a66fbda6178bccf
-
SHA1
f007b27c0cdea933d6c7fb8b1763461bfe1dd7b9
-
SHA256
35fb4f09f8afbce75c4f41abc59621885278fa233586ed6929cb2de225eefb59
-
SHA512
397468f4765121d2615f12be3cae5ecc9b9537ecbb1709f176c0d11e4a8908283dccbedb9d13f02997ed074d09b9ccd3d34138f906cb6157ecb5aeb8d5c5661b
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFR3:m5nkFNMOtEvwDpjG8hhXl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2364-0-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 C:\Users\Admin\AppData\Local\Temp\misid.exe CryptoLocker_rule2 behavioral2/memory/2364-16-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral2/memory/4652-54-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2364-16-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 behavioral2/memory/4652-54-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2364-0-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress C:\Users\Admin\AppData\Local\Temp\misid.exe INDICATOR_EXE_Packed_MPress behavioral2/memory/2364-16-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/4652-54-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exemisid.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation misid.exe -
Executes dropped EXE 1 IoCs
Processes:
misid.exepid process 4652 misid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exedescription pid process target process PID 2364 wrote to memory of 4652 2364 2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exe misid.exe PID 2364 wrote to memory of 4652 2364 2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exe misid.exe PID 2364 wrote to memory of 4652 2364 2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exe misid.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_a06cd550705e95523a66fbda6178bccf_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4652
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\misid.exeFilesize
39KB
MD5a16cf61a8ff414f44e98d84ca88549d0
SHA1b7fe16446b7b8fa44280f85ffd191b70cc12a735
SHA256fce8a79c61f072b50826bdb3f7fc96d34df8e8d16ac2cf3a53c902dc76273fec
SHA512d2e3cc029e877479dd0c1a5993f9f96d3f95d6be9cd6baac493f670901a7a18871bce30ea2c932470c18885940e76476599c3db1dde71d48a5be85a73f055eea
-
memory/2364-0-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/2364-1-0x00000000005A0000-0x00000000005A6000-memory.dmpFilesize
24KB
-
memory/2364-2-0x00000000005A0000-0x00000000005A6000-memory.dmpFilesize
24KB
-
memory/2364-3-0x00000000005C0000-0x00000000005C6000-memory.dmpFilesize
24KB
-
memory/2364-16-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB
-
memory/4652-20-0x0000000000840000-0x0000000000846000-memory.dmpFilesize
24KB
-
memory/4652-19-0x0000000000860000-0x0000000000866000-memory.dmpFilesize
24KB
-
memory/4652-54-0x0000000000500000-0x000000000050E000-memory.dmpFilesize
56KB