aa5290ebcb30a27f13d44e57525bbb950d8a5573ae148030ad756ffef7a487bd

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-18_813b03dcfa6914353b748733674b7a11_cryptolocker.exe
Size

54KB
MD5

813b03dcfa6914353b748733674b7a11
SHA1

3d3058d7b9f1b67b04425ebe31e5535fd48452e5
SHA256

aa5290ebcb30a27f13d44e57525bbb950d8a5573ae148030ad756ffef7a487bd
SHA512

e5e4ff6fb7abaeac76d74ccb996c79f2dc616ecf109c8831e660ae792f6670ae1442e7171f666d51df9fe77fc712f6616efb37f449cfaf7a906e0bab479bc024
SSDEEP

384:x0VkMq01bJ3wtEwPS8HLEh+Jagz+3be+26a4rIcVRYp055TOtOOtEvwDpjqIGR59:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbKo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4336-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000900000002314b-13.dat	CryptoLocker_rule2
behavioral2/memory/4336-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2364-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/4336-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000900000002314b-13.dat	CryptoLocker_set1
behavioral2/memory/4336-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2364-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral2/memory/4336-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000900000002314b-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4336-17-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2364-26-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-18_813b03dcfa6914353b748733674b7a11_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2364	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4336 wrote to memory of 2364	4336	2024-02-18_813b03dcfa6914353b748733674b7a11_cryptolocker.exe	84
PID 4336 wrote to memory of 2364	4336	2024-02-18_813b03dcfa6914353b748733674b7a11_cryptolocker.exe	84
PID 4336 wrote to memory of 2364	4336	2024-02-18_813b03dcfa6914353b748733674b7a11_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-18_813b03dcfa6914353b748733674b7a11_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-18_813b03dcfa6914353b748733674b7a11_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4336
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
c202a0ed4ad4c1607a2d3f495cd8bd3b

SHA1
53bf46ca3dc6d20af83beea4bbe800da61290f00

SHA256
26eb0207942a5e260f0d6e1d2090fa5a7c949a0d2c0ffa881aeea60883544869

SHA512
4f3fc940f1c5e0406b3575fd54791c335b1a3b2eeaed2a5b55c3f52b199edd520d588db67d9a44e1f2872d857e905a5dfc7956abc55a519290f1db3d128848b5

Download Submit
memory/2364-19-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/2364-21-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/2364-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4336-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4336-1-0x0000000000830000-0x0000000000836000-memory.dmp

Filesize
24KB

Download
memory/4336-2-0x0000000000830000-0x0000000000836000-memory.dmp

Filesize
24KB

Download
memory/4336-3-0x0000000000850000-0x0000000000856000-memory.dmp

Filesize
24KB

Download
memory/4336-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download