c33ffbc72532544a1794e19089f13ad7fe4dfa78b2082c472c24decf0222bb67

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2024, 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_8d21680f2370ab875cc240bdf490119c_cryptolocker.exe
Size

47KB
MD5

8d21680f2370ab875cc240bdf490119c
SHA1

0f948f4fa4056a237aacb67d6d30767089043427
SHA256

c33ffbc72532544a1794e19089f13ad7fe4dfa78b2082c472c24decf0222bb67
SHA512

a54927876389b2ebb12c75d2944338e2929bd551f1d9f5ad287257d2647118e3d71cfeb024e38abdf29f53743c743f2c6fd1e6524fffb1d759c87ec2a9a96dfc
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1wsO:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ18

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c00000002314f-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-02-17_8d21680f2370ab875cc240bdf490119c_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3980	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2600 wrote to memory of 3980	2600	2024-02-17_8d21680f2370ab875cc240bdf490119c_cryptolocker.exe	85
PID 2600 wrote to memory of 3980	2600	2024-02-17_8d21680f2370ab875cc240bdf490119c_cryptolocker.exe	85
PID 2600 wrote to memory of 3980	2600	2024-02-17_8d21680f2370ab875cc240bdf490119c_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-17_8d21680f2370ab875cc240bdf490119c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_8d21680f2370ab875cc240bdf490119c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2600
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
47KB

MD5
509aaceca275c2647318b7922663a6cc

SHA1
5d6c3784a4ab2135c3656caa953af2f2fd0cb549

SHA256
6c6a46179190580445f30955541673e5c648d43857a1e1d4dc031a7067af5bf8

SHA512
3166ef9f6c7d1b022ae397908719aa25218ec4c588c023a5f4009f1fbcfa6390e9a8f1ac00325c7afd44d523840b64165c66591727ff9102cb8f3d275866acb8

Download Submit
memory/2600-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/2600-1-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/2600-2-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/2600-3-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/2600-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/3980-18-0x0000000000630000-0x0000000000636000-memory.dmp

Filesize
24KB

Download
memory/3980-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3980-24-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download