136ce04eb38eaa1badb166fdf832993675b7b8d4e9c25c4e9cd79546cb9a899d

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23-02-2024 02:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_ffb1b62d3b180d7a3230d9f27ffc0b4c_cryptolocker.exe
Size

127KB
MD5

ffb1b62d3b180d7a3230d9f27ffc0b4c
SHA1

7bfdf4d92c357db172148907d0019e6ac30909c8
SHA256

136ce04eb38eaa1badb166fdf832993675b7b8d4e9c25c4e9cd79546cb9a899d
SHA512

047266a9c36e227809bee2f2a0b5f3d1c3ca2e0cf3bc5b4615d0bdb8bc433893793ae0afee79d19d6037dc754ba76a4eec97d7d4f91b378feff9b9e6e04e1cf5
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//fR1:vCjsIOtEvwDpj5H9YvQd2R1

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00040000000006e1-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x00040000000006e1-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2200714112-3788720386-2559682836-1000\Control Panel\International\Geo\Nation	2024-02-23_ffb1b62d3b180d7a3230d9f27ffc0b4c_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3388	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 532 wrote to memory of 3388	532	2024-02-23_ffb1b62d3b180d7a3230d9f27ffc0b4c_cryptolocker.exe	88
PID 532 wrote to memory of 3388	532	2024-02-23_ffb1b62d3b180d7a3230d9f27ffc0b4c_cryptolocker.exe	88
PID 532 wrote to memory of 3388	532	2024-02-23_ffb1b62d3b180d7a3230d9f27ffc0b4c_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-23_ffb1b62d3b180d7a3230d9f27ffc0b4c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_ffb1b62d3b180d7a3230d9f27ffc0b4c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:532
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
127KB

MD5
f53ce95e7633de95a13b4442966c0951

SHA1
4e3fc23956f40f1d26f9ba293e181a8f19944f99

SHA256
c92108658fa05891e5ca33b11136a47c7a8eacad497e784d9206e41f2b7a9f62

SHA512
8cd246e6d2a958ae669c2c0835e078e20039e07bd4d3f7d3001b7a4a1899e5ba9a4c665ff94a7f13a22162f49aa996011b89cfea8aeb2dd67bf34a6e1200d2ed

Download Submit
memory/532-0-0x0000000000830000-0x0000000000836000-memory.dmp

Filesize
24KB

Download
memory/532-1-0x0000000000830000-0x0000000000836000-memory.dmp

Filesize
24KB

Download
memory/532-2-0x0000000000850000-0x0000000000856000-memory.dmp

Filesize
24KB

Download
memory/3388-17-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/3388-19-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download