80bbf67706915ff7adcaadb8dc2c7f090adc88f5fe2c6da01cf3814284bdcf3a

Analysis

max time kernel
144s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12-02-2024 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-12_0329e6aca44d371676b3c3449f7b5736_cryptolocker.exe
Size

80KB
MD5

0329e6aca44d371676b3c3449f7b5736
SHA1

ffff1b97dee7d18f9445d821f18883b2cede1b25
SHA256

80bbf67706915ff7adcaadb8dc2c7f090adc88f5fe2c6da01cf3814284bdcf3a
SHA512

49de0a8276ae3949cf13344ac12c7ea22bf873c012b2b6bc23b52a585dc3a692d0418c58f5af66bf6a4f2f679d6b219494177f952645c404e61678419d35d28b
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHuw:vCjsIOtEvwDpj5H9YvQd2R

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000e000000023168-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000e000000023168-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	2024-02-12_0329e6aca44d371676b3c3449f7b5736_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
1220	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 1220	1136	2024-02-12_0329e6aca44d371676b3c3449f7b5736_cryptolocker.exe	85
PID 1136 wrote to memory of 1220	1136	2024-02-12_0329e6aca44d371676b3c3449f7b5736_cryptolocker.exe	85
PID 1136 wrote to memory of 1220	1136	2024-02-12_0329e6aca44d371676b3c3449f7b5736_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-12_0329e6aca44d371676b3c3449f7b5736_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-12_0329e6aca44d371676b3c3449f7b5736_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
80KB

MD5
eeebe166ab81b27d477a0de68c5d87d6

SHA1
3e5ec53f68d30f2483f14921d0ea750db1a78ded

SHA256
8a28b8d4aba2ef160eed92b7122be2e74a11190355daa70ddee0914b2a90b655

SHA512
d0558faeb07786d133b7111a75a2b02c9817fcc48933004d87e73d2a50b55e4c5d248f089ca749427888d8c33a021134d4f1fc82396cd2dac6d62b8f906eb958

Download Submit
memory/1136-0-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/1136-1-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/1136-2-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download
memory/1220-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1220-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download