83b07b139b9e4dbfc6befb163e4f33f850c2e3f50ab34d199ebcd830fbdc99d2

Analysis

max time kernel
88s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 17:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exe
Size

62KB
MD5

d00033ebfdfbfd25f1339702c51557c8
SHA1

4ca75be059ca4996ecd757a7ab4a88755cdbb43d
SHA256

83b07b139b9e4dbfc6befb163e4f33f850c2e3f50ab34d199ebcd830fbdc99d2
SHA512

c408aef5a00aa5cbc1bade0f2d3ba13fc51212c42ca8600468491bbbe0cd29d3214de9438232c16009640e079c09afbacd562648f08d541449b3468cc9f3f3a5
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEiNgh:6j+1NMOtEvwDpjr8ox8UDEiU

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral2/memory/5112-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3532-56-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral2/memory/5112-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3532-56-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/5112-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral2/memory/5112-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3532-56-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exemisid.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

3532 misid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3532	misid.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exe

description	pid	process	target process
PID 5112 wrote to memory of 3532	5112	2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exe	misid.exe
PID 5112 wrote to memory of 3532	5112	2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exe	misid.exe
PID 5112 wrote to memory of 3532	5112	2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_d00033ebfdfbfd25f1339702c51557c8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5112

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
62KB

MD5
1f8b9764048dccb874380a40b4339209

SHA1
d13650d14d1ee12a750c2a3d8e3217c7f0e362f9

SHA256
1612d63886ed81c0c834d8a5f838b4009b75c010dbb3d0710726054e74ac777c

SHA512
6b91717f872ae6b26ec962d15e90a72bfe7fe35b4ee0914bd5aa3ddfae4bba41475e7bb75802f7afe1d97f45b46a108a1c0006bd34eea7c503ab9e94784c0b84

Download Submit
memory/3532-19-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3532-22-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3532-56-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/5112-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/5112-1-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/5112-2-0x00000000007B0000-0x00000000007B6000-memory.dmp

Filesize
24KB

Download
memory/5112-3-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/5112-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download