194e170fe88c064749614520eafe125e3b42da7582e2a6a9290eaeb54240d670

Analysis

max time kernel
132s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-04_6fc4a5a6a57875a6842dfac6afbbba64_cryptolocker.exe
Size

39KB
MD5

6fc4a5a6a57875a6842dfac6afbbba64
SHA1

319bde82debaa765ff273cb09fa33a2ea9044144
SHA256

194e170fe88c064749614520eafe125e3b42da7582e2a6a9290eaeb54240d670
SHA512

ce1de797a8c4b77375bff99c8bc31a6d52c3b77ebcec4d425ef6c498bba8caba7203d655eadc9202b79ce06e088e017f0d81d31b104ae0d4798e382555e38deb
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRY/x:m5nkFNMOtEvwDpjG8hhXy/x

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/2844-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0007000000023124-13.dat	CryptoLocker_rule2
behavioral2/memory/2844-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3012-54-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/memory/2844-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3012-54-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral2/memory/2844-0-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023124-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2844-17-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3012-54-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	misid.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-02-04_6fc4a5a6a57875a6842dfac6afbbba64_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3012	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2844 wrote to memory of 3012	2844	2024-02-04_6fc4a5a6a57875a6842dfac6afbbba64_cryptolocker.exe	84
PID 2844 wrote to memory of 3012	2844	2024-02-04_6fc4a5a6a57875a6842dfac6afbbba64_cryptolocker.exe	84
PID 2844 wrote to memory of 3012	2844	2024-02-04_6fc4a5a6a57875a6842dfac6afbbba64_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-04_6fc4a5a6a57875a6842dfac6afbbba64_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_6fc4a5a6a57875a6842dfac6afbbba64_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2844
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
1ef028e3a3fa3191b35b267dedcad437

SHA1
ba0a808ebcfd0b1c01e40e8dec0e49f64803742c

SHA256
db44252d08aed012779676cbe4f71cd6ffdd4da2224589f8b3db69e92185832e

SHA512
87c809091ff1694547ec460557cdf21bccaa7c9f1d10b8eef55203fe884df51a7933f8a8462cf59452eaba982fa2b1a83703293064badeb8b4bcafbbfce3213e

Download Submit
memory/2844-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2844-1-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/2844-2-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/2844-3-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/2844-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/3012-19-0x0000000002090000-0x0000000002096000-memory.dmp

Filesize
24KB

Download
memory/3012-24-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3012-54-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download