a5ebbc759480893da9c9c0c33ad9e0c8613a5f272ade0915a21b4dce3540a5a7

Analysis

max time kernel
137s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-02-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe
Size

38KB
MD5

29f89b3ce7f95bdd0f595a9fa8697631
SHA1

7500953122eec5fd978367ecf0e2ffe0d96f15f0
SHA256

a5ebbc759480893da9c9c0c33ad9e0c8613a5f272ade0915a21b4dce3540a5a7
SHA512

d74df0ddf57e0c8a9e70b682aa4c36b885e28ae182cfee0e68d42cddf2df0fceda77ba1733709325eaa328374e2fdd98d70301859e537da1ce0cf73c379f8601
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLenQLLu:ZzFbxmLPWQMOtEvwDpjLeUq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023125-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4600	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1484 wrote to memory of 4600	1484	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe	84
PID 1484 wrote to memory of 4600	1484	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe	84
PID 1484 wrote to memory of 4600	1484	2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-19_29f89b3ce7f95bdd0f595a9fa8697631_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1484
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
39KB

MD5
a3b993fcbb4244e32322cc834abe6771

SHA1
9b9ac57ea6af6e306a59553bf731731c006c50d0

SHA256
cddb86701ca0e6c3462bb5d93ebba3e3836f741f4125f78fa44e5389276d354d

SHA512
ca375355d62c9e08f59fde0569054b3b4bcc25adebe1c8445a9045ffd54fbc9eb393abca909f1323cc9a89fc6260fe0c86ab334379cbd84de58a1a064c1cbeef

Download Submit
memory/1484-0-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/1484-1-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/1484-2-0x0000000000810000-0x0000000000816000-memory.dmp

Filesize
24KB

Download
memory/4600-16-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/4600-18-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4600-20-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4600-25-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download