5d695912c0d7071b713b8d360246e6d682ef9537ece44adfb35219b04c53c8e8

Analysis

max time kernel
144s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
28/01/2024, 23:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_3d8a2f839da3e6742a41c14bdbf0662d_cryptolocker.exe
Size

45KB
MD5

3d8a2f839da3e6742a41c14bdbf0662d
SHA1

74c975b47db5c2847c3dee7c30ce3bcd965365b5
SHA256

5d695912c0d7071b713b8d360246e6d682ef9537ece44adfb35219b04c53c8e8
SHA512

46c0562a7865d1daa081e4067f796a50ab8f67660eb5ceab9f550d0fed5e7118fd91f690178e8bd413fefbfaeb8bb8ccf963d34b1be37ba8288972473c4adc1a
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1wsK:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ1g

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral2/files/0x000700000002321f-13.dat	CryptoLocker_rule2
behavioral2/files/0x000700000002321f-16.dat	CryptoLocker_rule2
behavioral2/files/0x000700000002321f-15.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	2024-01-28_3d8a2f839da3e6742a41c14bdbf0662d_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
1772	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1772	4216	2024-01-28_3d8a2f839da3e6742a41c14bdbf0662d_cryptolocker.exe	18
PID 4216 wrote to memory of 1772	4216	2024-01-28_3d8a2f839da3e6742a41c14bdbf0662d_cryptolocker.exe	18
PID 4216 wrote to memory of 1772	4216	2024-01-28_3d8a2f839da3e6742a41c14bdbf0662d_cryptolocker.exe	18

C:\Users\Admin\AppData\Local\Temp\2024-01-28_3d8a2f839da3e6742a41c14bdbf0662d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_3d8a2f839da3e6742a41c14bdbf0662d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
becb3410d9fab96c4399dfbf5ae568d7

SHA1
37a90ed1b0f7e614dd5dc80dec5ad3c5a4921549

SHA256
244623ac38333e2bb57a5f3799bd25caece0f5c1890a22afbda001692153a80a

SHA512
8cd0a4d5ef14e9ba74a07fd76d6c29ff4477cc955fc1bc1632bd550bb958922d079994bbbb919efb536a9f1791626dc64bd348d2439729be74f26db4e1aace9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
45KB

MD5
6614660c9d5a9d5171c7ea40fa55117c

SHA1
a5bb2307b2a76e5a7c170411f1c03f7d22946a0a

SHA256
1194a7b6d04a3a0428806ad01a3ea831186a30ddbb1274803b12bb18d90b2716

SHA512
dedebfb0cbaaea919e37730fdca7d5e07bd2aef899455e1bcce6b93398fe24d9335f8de16b8ce95d025e722e1fd1690410559056aafecfbbeb8668db19bcb125

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
12KB

MD5
93b293e09b1541ba42203b84165dfa8a

SHA1
9e8b017a1f59aba076bc4906a42b520701358a0d

SHA256
948f5db67b148627da0995cfa0ff87989ef94ddfb0f431311c55636407c2fdb6

SHA512
d9b3269d7667c1b75e041f8559b3b91b95d5ffab589ee381f28ef1e59af5bfdd58e7314892496bb58935d11075d79c4f2c3337eb74bdddc39e51ad24c910dff7

Download Submit
memory/1772-18-0x0000000001EE0000-0x0000000001F20000-memory.dmp

Filesize
256KB

Download
memory/1772-26-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/1772-20-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/4216-0-0x00000000004F0000-0x00000000004F3000-memory.dmp

Filesize
12KB

Download
memory/4216-3-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download
memory/4216-2-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/4216-1-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/4216-17-0x00000000004F0000-0x00000000004F3000-memory.dmp

Filesize
12KB

Download