e1cad76590afcd7d45cc8259fe6def9b52df5716f7118453e2f92d51479ecdf1

Analysis

max time kernel
134s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18-02-2024 23:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_30200bce3174ec89ffb9fa8c912cfcb8_cryptolocker.exe
Size

55KB
MD5

30200bce3174ec89ffb9fa8c912cfcb8
SHA1

51dad2c77895038cbf583acdbe2519470215da0d
SHA256

e1cad76590afcd7d45cc8259fe6def9b52df5716f7118453e2f92d51479ecdf1
SHA512

539782cc89c3bade1895f3501deecb321c038ebd4ec2d5b67f379370c913dd1a6f50a762cf11b403cf0b083fa07a6a4745a430f80d7580fc4467f762d921a5c2
SSDEEP

1536:vj+jsMQMOtEvwDpj5HH1nw73KOFsiM3JD:vCjsIOtEvwDpj5Hb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023112-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023112-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-02-18_30200bce3174ec89ffb9fa8c912cfcb8_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2596	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2596	1676	2024-02-18_30200bce3174ec89ffb9fa8c912cfcb8_cryptolocker.exe	83
PID 1676 wrote to memory of 2596	1676	2024-02-18_30200bce3174ec89ffb9fa8c912cfcb8_cryptolocker.exe	83
PID 1676 wrote to memory of 2596	1676	2024-02-18_30200bce3174ec89ffb9fa8c912cfcb8_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-02-18_30200bce3174ec89ffb9fa8c912cfcb8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_30200bce3174ec89ffb9fa8c912cfcb8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
dcbadc96e3600fcbdd3a36a72967e59d

SHA1
815c05e937a0df02b1afe15cb31f0bd58586799e

SHA256
38d087664ce412b4eca67a9b3eb8c257f2e909b3de9b409b1fa24a8b045b02bb

SHA512
e4aefe5e1bcb511f18aad6b67f7dfb22172a6c48b65172a0c5bf9426f8886d47100c617f863dcf1789cebe26aea29f61c79db959099c77a118382ccbe9ea7776

Download Submit
memory/1676-0-0x0000000002310000-0x0000000002316000-memory.dmp

Filesize
24KB

Download
memory/1676-1-0x0000000002310000-0x0000000002316000-memory.dmp

Filesize
24KB

Download
memory/1676-2-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/2596-17-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/2596-19-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download