76702925cdc22c05afd37201e1d5089ab33585120798098c56bd83e0ba36f39c

Analysis

max time kernel
87s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_de2feced9f55413662e0866bd6a56ce4_cryptolocker.exe
Size

96KB
MD5

de2feced9f55413662e0866bd6a56ce4
SHA1

084c1235219650273fb76636f7085ba333077fe0
SHA256

76702925cdc22c05afd37201e1d5089ab33585120798098c56bd83e0ba36f39c
SHA512

70de1637c5278214bd2cfc6afe83a6780fa32b7b033f6872c88b4d9a102d86bad70d7e2b3547bcfafa98794350612db3fd5a9d3d8538c53bd6643aed126caf37
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJvfT3+:xj+VGMOtEvwDpjubwQEIiVmkf+

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/3772-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0008000000023222-13.dat	CryptoLocker_rule2
behavioral2/memory/1324-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3772-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1324-55-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral2/memory/3772-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0008000000023222-13.dat	CryptoLocker_set1
behavioral2/memory/1324-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3772-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/1324-55-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/3772-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000023222-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1324-18-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3772-17-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1324-55-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	2024-02-12_de2feced9f55413662e0866bd6a56ce4_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
1324	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 1324	3772	2024-02-12_de2feced9f55413662e0866bd6a56ce4_cryptolocker.exe	85
PID 3772 wrote to memory of 1324	3772	2024-02-12_de2feced9f55413662e0866bd6a56ce4_cryptolocker.exe	85
PID 3772 wrote to memory of 1324	3772	2024-02-12_de2feced9f55413662e0866bd6a56ce4_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-12_de2feced9f55413662e0866bd6a56ce4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_de2feced9f55413662e0866bd6a56ce4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
96KB

MD5
db882311342a143b30aa04e6f18343d8

SHA1
9b25c220d60095cc27e237d659f6823ac971d3f5

SHA256
1210f587ca82a7bb86b9af8415f47ea5a56b25d67c54e9238f3e0db383c98ada

SHA512
cd835a3391ab32f3a84522a0c6af729e742aea800fb95d103ddf761be7f90e9faf374515438b27877a6695131d6a5c84d2edf1c9c62a0982138de6599b2abbdd

Download Submit
memory/1324-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1324-20-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/1324-22-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/1324-55-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3772-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3772-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3772-2-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/3772-3-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/3772-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download