96313951bec6321631e8ecc17435adc0de7848dfadab3ae351b8dceb04f2f35f

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 08:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe
Size

124KB
MD5

5f0de26233ce5e3ca3a99f24e5d21e27
SHA1

0d7f62d4ded65db2fceb0e378829e80df91ae029
SHA256

96313951bec6321631e8ecc17435adc0de7848dfadab3ae351b8dceb04f2f35f
SHA512

0bf7e963bdd82685d5f30297066842a7ca0881d49c2b403225ee8e3424e9f7588f32fe3a9debadb49a445f762c78ca343893e436fe900cdf640961f014731fe8
SSDEEP

1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxE4f:vCA9OtEvwDpjm

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001e597-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000b00000001e597-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1712835645-2080934712-2142796781-1000\Control Panel\International\Geo\Nation	2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4868	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4868	3556	2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe	90
PID 3556 wrote to memory of 4868	3556	2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe	90
PID 3556 wrote to memory of 4868	3556	2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_5f0de26233ce5e3ca3a99f24e5d21e27_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
124KB

MD5
249f826b243ba2a97d277ae0a2ebe858

SHA1
e4d7e9471f251504274c6c541afcc7ec716ffadb

SHA256
dfdc242df2c25d80e7bb2035d4c8d81105b60ca1bf90f92fb2e21fa3c7867323

SHA512
57bab10541e6d64d412b2136878bdd0a13245631b6ad3b88211ed4f86a92408dd0e27ed09d188bd2434a72e1d09327468722fe0af394f87ad84937145865456d

Download Submit
memory/3556-0-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/3556-1-0x0000000000690000-0x0000000000696000-memory.dmp

Filesize
24KB

Download
memory/3556-2-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4868-17-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4868-19-0x00000000004C0000-0x00000000004C6000-memory.dmp

Filesize
24KB

Download