39f66ff21ede4aba8ac383492ca9ffe56317b42a277a6fab1a81a637fb7d0416

Analysis

max time kernel
143s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-24_b27b2d90d6f6f88346ebb7e0db3e5df3_cryptolocker.exe
Size

60KB
MD5

b27b2d90d6f6f88346ebb7e0db3e5df3
SHA1

a12f0e1878573f46d6060e59bf4edd84c074603a
SHA256

39f66ff21ede4aba8ac383492ca9ffe56317b42a277a6fab1a81a637fb7d0416
SHA512

8ff9f0c20e27a397c0544d3b5084f00e84f1fcdf9ee833c96970386cefadf8f15c09f849013a872b4d4d3f5a71615d8cb489af579d48cc2cef51251a66e93f1c
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdOyJT/EN:ZVxkGOtEvwDpjcOS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00060000000230fd-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3844919115-497234255-166257750-1000\Control Panel\International\Geo\Nation	2024-02-24_b27b2d90d6f6f88346ebb7e0db3e5df3_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4136	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4052 wrote to memory of 4136	4052	2024-02-24_b27b2d90d6f6f88346ebb7e0db3e5df3_cryptolocker.exe	86
PID 4052 wrote to memory of 4136	4052	2024-02-24_b27b2d90d6f6f88346ebb7e0db3e5df3_cryptolocker.exe	86
PID 4052 wrote to memory of 4136	4052	2024-02-24_b27b2d90d6f6f88346ebb7e0db3e5df3_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-24_b27b2d90d6f6f88346ebb7e0db3e5df3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-24_b27b2d90d6f6f88346ebb7e0db3e5df3_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4052
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
60KB

MD5
8ea29f3a61618cd19b9b3bc800adc6f0

SHA1
056559c9a2cb82dc7578921be042e45127c89600

SHA256
02394485496ee23c4b1ae4f2a61d5cd8d26f35f774321d4511e426c3539b86d7

SHA512
5e57b25cfac0b46c7899faf97988ad4e48591454669dd706840e13ae6ba85f481c0f5334dd0a4919e13831c638f08509be2384bb0343ac0b3ec7e21ad05b4033

Download Submit
memory/4052-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/4052-1-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4052-2-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4052-3-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/4052-19-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/4136-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/4136-20-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/4136-23-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download