beec0016449d364a449e88873d69568c98372fca210f08e936cb5c88f5a64f83

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
23/02/2024, 06:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_8732ddc0244be0cdea69bf89494386a6_cryptolocker.exe
Size

40KB
MD5

8732ddc0244be0cdea69bf89494386a6
SHA1

224feed5e320793c2c03d9fc01b8498578d80869
SHA256

beec0016449d364a449e88873d69568c98372fca210f08e936cb5c88f5a64f83
SHA512

0c218d647266f5f813fdf36be5a84eda98781bb58028f5944cb28d467a678f940470d25483efad3871e1811362acb51158c66fbff7b3babef7683bdaa2a3dfc9
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRW:m5nkFNMOtEvwDpjG8hhXI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/3240-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0006000000023106-13.dat	CryptoLocker_rule2
behavioral2/memory/3240-20-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4996-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/memory/3240-20-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4996-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral2/memory/3240-0-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0006000000023106-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3240-20-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4996-26-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	2024-02-23_8732ddc0244be0cdea69bf89494386a6_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4996	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 4996	3240	2024-02-23_8732ddc0244be0cdea69bf89494386a6_cryptolocker.exe	88
PID 3240 wrote to memory of 4996	3240	2024-02-23_8732ddc0244be0cdea69bf89494386a6_cryptolocker.exe	88
PID 3240 wrote to memory of 4996	3240	2024-02-23_8732ddc0244be0cdea69bf89494386a6_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-23_8732ddc0244be0cdea69bf89494386a6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_8732ddc0244be0cdea69bf89494386a6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
40KB

MD5
5b82c19b2c3eca9415a042a95f81c0ae

SHA1
bdc21df540323c3b71847234f3d4889726419b20

SHA256
235a425f053200375d25e3b1c4a2f24cc58190f5bc094087fb0537e08456b7cb

SHA512
ee1646cb3267273c7ea78d297e7efa8449d85ef0a5f963678508a4715fb0b640e4ef1931604a9eb130f6c331fad730b63809cf389d228737262b5bdeb6b25ec8

Download Submit
memory/3240-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/3240-1-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/3240-2-0x00000000007F0000-0x00000000007F6000-memory.dmp

Filesize
24KB

Download
memory/3240-3-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/3240-20-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4996-19-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/4996-18-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4996-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download