798e602e244681c3f21276572b76557955b5b66f06ee6595b598cbc301795ee3

Analysis

max time kernel
89s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 10:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_bb175a83ef4a01552051d790b701d18d_cryptolocker.exe
Size

35KB
MD5

bb175a83ef4a01552051d790b701d18d
SHA1

e8400222c03ca664a0ea074d8184cc41b355ff89
SHA256

798e602e244681c3f21276572b76557955b5b66f06ee6595b598cbc301795ee3
SHA512

0c001caaf757652061760b7360226a1897a26671d6c0cde13de62d40ba099b90d584af7714c20c91de01b3df69788f55af788736c4792390dad8bc07e94bb08c
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAYd:ZzFbxmLPWQMOtEvwDpjLeJAYd

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231df-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	2024-02-12_bb175a83ef4a01552051d790b701d18d_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
4624	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 4624	2800	2024-02-12_bb175a83ef4a01552051d790b701d18d_cryptolocker.exe	84
PID 2800 wrote to memory of 4624	2800	2024-02-12_bb175a83ef4a01552051d790b701d18d_cryptolocker.exe	84
PID 2800 wrote to memory of 4624	2800	2024-02-12_bb175a83ef4a01552051d790b701d18d_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-12_bb175a83ef4a01552051d790b701d18d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_bb175a83ef4a01552051d790b701d18d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
35KB

MD5
d07762cea59bb0f9274f11c935425d65

SHA1
5da24c515612f1be5a05d7ec4867af89fa4eab9d

SHA256
43fd3440b87f64666dbe03c2f348c830bde84b579b427b9463c08bdffd682421

SHA512
a2432678ae737a466f7aa2876074428f7233843eb1a192f939766d5fe5b420af61c99a0e9c85001e1e38cb4c738622b3d103d8962163a5f166e09e8e66a652a4

Download Submit
memory/2800-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/2800-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2800-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2800-3-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/4624-18-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/4624-19-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/4624-21-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4624-54-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download