cc111f4cbe2f5fc93d82dbd2cb246f6c7e12d32f18e7aa45c483fe5504af1984

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 23:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_a673ad93c4d04fc4cc9433d3ff75d869_cryptolocker.exe
Size

46KB
MD5

a673ad93c4d04fc4cc9433d3ff75d869
SHA1

9d89a2501ca25830f4c77ed5c32b9ca9a0ef524e
SHA256

cc111f4cbe2f5fc93d82dbd2cb246f6c7e12d32f18e7aa45c483fe5504af1984
SHA512

5b9ac2e9480b886491a3cd19f53b048cebc94899914b802fb957b8c5e44834df1bb763cdb45f4b934f056cdbfda32c11c40baba1512a00a6b501d8e3b730ecff
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8z2iaSIO/WZrEu/d+qmsUHQ1wsn:ZzFbxmLPWQMOtEvwDpj386Sj/WprqQ1p

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002311b-14.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	2024-02-23_a673ad93c4d04fc4cc9433d3ff75d869_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2192	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 2192	1132	2024-02-23_a673ad93c4d04fc4cc9433d3ff75d869_cryptolocker.exe	88
PID 1132 wrote to memory of 2192	1132	2024-02-23_a673ad93c4d04fc4cc9433d3ff75d869_cryptolocker.exe	88
PID 1132 wrote to memory of 2192	1132	2024-02-23_a673ad93c4d04fc4cc9433d3ff75d869_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-23_a673ad93c4d04fc4cc9433d3ff75d869_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_a673ad93c4d04fc4cc9433d3ff75d869_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
46KB

MD5
754e159b10d4ca801a5992d02f5eaf6e

SHA1
0ddb9fe28cf36eb2f05376bcae3096bfc3967e4d

SHA256
87ba6285bf1747fecabbb8f5b548d844cc2166ec279613f61d694d22e51b3d04

SHA512
b0087c1d7c23867093c4e52609a21c87f7123bd6eaf3e856a91cc433cc0875bac4d66c6d4de7745e4094dab81b31e066566d3c317310ce6b562620f853e9c81d

Download Submit
memory/1132-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/1132-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/1132-2-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/1132-3-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/1132-10-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/2192-18-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2192-21-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/2192-20-0x00000000020E0000-0x00000000020E6000-memory.dmp

Filesize
24KB

Download
memory/2192-27-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download