7e0264f4f0de5c9c427c630a7d465f388bfefe9d2bb40b250984a1424c76d719

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17-02-2024 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_34da369ce4670180c61021a24768c820_cryptolocker.exe
Size

78KB
MD5

34da369ce4670180c61021a24768c820
SHA1

914b9f50b803361b4b0187c5a0fa6713f4eecfa2
SHA256

7e0264f4f0de5c9c427c630a7d465f388bfefe9d2bb40b250984a1424c76d719
SHA512

cecacc01b020f923906d0171122c7e476d4d21b6a155bc53586dacf15f088880ff251cb66cfa237f6a559cb7333cb45e17e217a8250dec0d74c1f5bff0778e90
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWaO0O:vCjsIOtEvwDpj5H9YvQd2I

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000002315a-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000002315a-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-02-17_34da369ce4670180c61021a24768c820_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4672	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4672	4848	2024-02-17_34da369ce4670180c61021a24768c820_cryptolocker.exe	84
PID 4848 wrote to memory of 4672	4848	2024-02-17_34da369ce4670180c61021a24768c820_cryptolocker.exe	84
PID 4848 wrote to memory of 4672	4848	2024-02-17_34da369ce4670180c61021a24768c820_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-17_34da369ce4670180c61021a24768c820_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_34da369ce4670180c61021a24768c820_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4672

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
edac303b0df5f3e37d4473a0a5d68ebb

SHA1
b925946c73c0089e4afc1bdc0a9733cb90d6ab24

SHA256
882bd88a174aec41597a0149304ed1216dc1b6dd02f4ab27e512a356a8142736

SHA512
743fc4d75ea00060345905aa5e28aabeac0a60fe65540646b58ed3d413123e0a2ba3c6f31da8de3d59e4168a1368d065111b75e444cdc3554b758df0435eea07

Download Submit
memory/4672-17-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/4672-19-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4848-0-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4848-1-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4848-2-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download