82739e2482912bf033a30af35e198487b89d99d85d4868b16b7446633919eb7b

Analysis

max time kernel
139s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 17:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exe
Size

81KB
MD5

b8e79e98ff564bb04cc40d06b8e5cdbb
SHA1

1c1a92429e33f7ccb9ad72d0a84484df78b767cf
SHA256

82739e2482912bf033a30af35e198487b89d99d85d4868b16b7446633919eb7b
SHA512

1fff03cadb15d17bd662f703fd5b6e9f2ed33b05f70d8174db4809918a64e5db40a7dda2b87a973bb846c19c863e10c7d67bf2f01216a42122f70742b614b375
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMAea:TCjsIOtEvwDpj5HE/OUHnSMI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4736-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral2/memory/4736-18-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4948-53-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4736-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral2/memory/4736-18-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4948-53-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exemisid.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

4948 misid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4948	misid.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exe

description	pid	process	target process
PID 4736 wrote to memory of 4948	4736	2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exe	misid.exe
PID 4736 wrote to memory of 4948	4736	2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exe	misid.exe
PID 4736 wrote to memory of 4948	4736	2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_b8e79e98ff564bb04cc40d06b8e5cdbb_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4736

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
81KB

MD5
ca944c77b0b86cc3dbbc780e854752ca

SHA1
25c89cb48024c8bc53fe25a905cbc3566a507f7c

SHA256
7281fcc35929be42ab973a43b51a1f04f9c6ae56ecc7c0f7327253abdf1f22d3

SHA512
20d245b16f8839b5a046318bd8a2deeee10530fe10b4a18c95f4e139fec0d9b0e5f6cb5556b6027ad0efbccccf97b44609de78aafe82865f63ba3013644704b9

Download Submit
memory/4736-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4736-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4736-2-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4736-3-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/4736-18-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4948-19-0x0000000001F70000-0x0000000001F76000-memory.dmp

Filesize
24KB

Download
memory/4948-53-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download