5f75254a33766f674464c8e0d35be5e8034fdd282e0050b2e18ac5f626c9b925

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 17:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exe
Size

100KB
MD5

f8bdadb7fc8ed3e1aa32b67cc5f86ec1
SHA1

e53bf0abb10c3df9e51e5b381dbbb0c063112f0d
SHA256

5f75254a33766f674464c8e0d35be5e8034fdd282e0050b2e18ac5f626c9b925
SHA512

d7c7f530f1c44ab32b4bd91400a91a22a5094e5ea571161fe342265d830681cde1bc1792763ca7687812cd415fa59c006e8bfff14ae2a0108f35cdf58ba12848
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJHlv/k2j:xj+VGMOtEvwDpjubwQEIiVmkxv/n

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3236-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_rule2
behavioral2/memory/3236-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/5068-54-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3236-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
C:\Users\Admin\AppData\Local\Temp\misid.exe	CryptoLocker_set1
behavioral2/memory/3236-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/5068-54-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3236-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
C:\Users\Admin\AppData\Local\Temp\misid.exe	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3236-17-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/5068-54-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exemisid.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

Processes:

misid.exe

pid process

5068 misid.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
5068	misid.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exe

description	pid	process	target process
PID 3236 wrote to memory of 5068	3236	2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exe	misid.exe
PID 3236 wrote to memory of 5068	3236	2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exe	misid.exe
PID 3236 wrote to memory of 5068	3236	2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exe	misid.exe

C:\Users\Admin\AppData\Local\Temp\2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_f8bdadb7fc8ed3e1aa32b67cc5f86ec1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3236

C:\Users\Admin\AppData\Local\Temp\misid.exe
"C:\Users\Admin\AppData\Local\Temp\misid.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
100KB

MD5
ae18f41d262b63d6f030dd5a83d16da5

SHA1
052b29689909942710bb1470b8521d5eb0b295f0

SHA256
2158ffdd2d8989c684a1c820dcd9b73d5b5f9efd1265b07e6c5ed2b0c8c14b83

SHA512
e09cbcf68b2f9f01d8a88f74412c838459cef635e02557374bcf38305771b0f4cb257f9d55737acf05a0a3204f5216e915963d54c30854bee3d524fabdc4a810

Download Submit
memory/3236-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3236-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/3236-2-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/3236-3-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/3236-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/5068-21-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/5068-19-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/5068-54-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download