b1d2dfe8c8528bd6e4533ed7ff8f44952c709433defb9ec24852e463d4a318df

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 22:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_953282692186a8cfd4a7e67a8370dfe9_cryptolocker.exe
Size

65KB
MD5

953282692186a8cfd4a7e67a8370dfe9
SHA1

8bc10dc5930795156d6509f4c200216d4ecb729d
SHA256

b1d2dfe8c8528bd6e4533ed7ff8f44952c709433defb9ec24852e463d4a318df
SHA512

50af2e9e3f6e624cade2e3a8470b85bf796effb5b60f9fd05c56b2314e979d9c8118818fc1d45a7f54bcd338a2b36f9bd7dbfebf690fb38feb0317b70618c85f
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD:i5nkFGMOtEvwDpjNbwQEI8UZD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/3296-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0007000000023220-13.dat	CryptoLocker_rule2
behavioral2/memory/3496-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3296-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3496-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral2/memory/3496-18-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3296-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3496-27-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/3296-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023220-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3496-18-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3296-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3496-27-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-768304381-2824894965-3840216961-1000\Control Panel\International\Geo\Nation	2024-02-17_953282692186a8cfd4a7e67a8370dfe9_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3496	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 3496	3296	2024-02-17_953282692186a8cfd4a7e67a8370dfe9_cryptolocker.exe	85
PID 3296 wrote to memory of 3496	3296	2024-02-17_953282692186a8cfd4a7e67a8370dfe9_cryptolocker.exe	85
PID 3296 wrote to memory of 3496	3296	2024-02-17_953282692186a8cfd4a7e67a8370dfe9_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-17_953282692186a8cfd4a7e67a8370dfe9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_953282692186a8cfd4a7e67a8370dfe9_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3496

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
a1d5657888824f980f000519d2ab3381

SHA1
a9a3dbc891f245380dfd5c585f3f78c3ecd9e973

SHA256
652606256be89f43bef70f9e0fdf895ef12f24cabcb9adc852aab73b42506ecf

SHA512
5819df03ec35143c20d1033f19ee054ec9cd512935166e2c91af8242a06ab87f14c11d885416182264efa5fb90fda04b43c5b29d2ea4911d5384f3bc72281b7d

Download Submit
memory/3296-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3296-1-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/3296-2-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download
memory/3296-3-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/3296-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3496-18-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3496-22-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3496-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3496-27-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download