671e12731b69e6ef69683d7c2f384a63d97e1fd29ffea205a9a3cf8244eefeb9

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 18:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-03_ab361da61efcba3ad11a0d59f2d098a1_cryptolocker.exe
Size

54KB
MD5

ab361da61efcba3ad11a0d59f2d098a1
SHA1

807532e41a738260d8588135f6d23221459c5eef
SHA256

671e12731b69e6ef69683d7c2f384a63d97e1fd29ffea205a9a3cf8244eefeb9
SHA512

e556337a4edfc1bd3eb81ba77ba1cf398731a9825359783a88a698777a0b868f19f72fc17f4fbd9889fb2287a12e790faa7ef5d59a55b952d25b73bdcd6d83a6
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCW1nw71TkhsiPn1YFv0itq3F:vj+jsMQMOtEvwDpj5HH1nw73KOFsiM3F

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023151-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023151-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	2024-02-03_ab361da61efcba3ad11a0d59f2d098a1_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
1696	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 848 wrote to memory of 1696	848	2024-02-03_ab361da61efcba3ad11a0d59f2d098a1_cryptolocker.exe	85
PID 848 wrote to memory of 1696	848	2024-02-03_ab361da61efcba3ad11a0d59f2d098a1_cryptolocker.exe	85
PID 848 wrote to memory of 1696	848	2024-02-03_ab361da61efcba3ad11a0d59f2d098a1_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-03_ab361da61efcba3ad11a0d59f2d098a1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_ab361da61efcba3ad11a0d59f2d098a1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:848
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
e35e7f5689ed485bee37c27781fb3e6e

SHA1
6def550f4dd7a07915e52f12ffeb31954963ad2f

SHA256
ae518abc3f48b813d961bd014005e7cebc3496ee91b729bb394969139710c4af

SHA512
580a87f94e518069586a00ef93001b548fa7b44653fefabf90089e1302e1af32f4b37e9089939e87549c9b159e74d391ddd3cbe54d46d12dd3f4a26a26744286

Download Submit
memory/848-0-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/848-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/848-2-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/1696-17-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/1696-23-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download