da26de73b5c0207a269e1b7ce507ad99f20a7aa851f553ded0b783c0dffab1e8

Analysis

max time kernel
145s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28-02-2024 11:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_00f4dcf11f38c3d7475952e44a7691a3_cryptolocker.exe
Size

82KB
MD5

00f4dcf11f38c3d7475952e44a7691a3
SHA1

1ec31749c330fb577833b2e8ea77f3f8187fe0f5
SHA256

da26de73b5c0207a269e1b7ce507ad99f20a7aa851f553ded0b783c0dffab1e8
SHA512

07e712db2b487a167254bef945f93cdd2f85c916a4b4642269ef95e64d82c3ac06b1619d0ebadc7f3f24a7481a19a07630647725325b3664381f5f55903ec47a
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMAe5/:TCjsIOtEvwDpj5HE/OUHnSMH

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/32-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000700000002320a-13.dat	CryptoLocker_rule2
behavioral2/memory/32-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2032-52-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/32-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000700000002320a-13.dat	CryptoLocker_set1
behavioral2/memory/32-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2032-52-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	2024-02-28_00f4dcf11f38c3d7475952e44a7691a3_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
2032	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 32 wrote to memory of 2032	32	2024-02-28_00f4dcf11f38c3d7475952e44a7691a3_cryptolocker.exe	90
PID 32 wrote to memory of 2032	32	2024-02-28_00f4dcf11f38c3d7475952e44a7691a3_cryptolocker.exe	90
PID 32 wrote to memory of 2032	32	2024-02-28_00f4dcf11f38c3d7475952e44a7691a3_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-02-28_00f4dcf11f38c3d7475952e44a7691a3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_00f4dcf11f38c3d7475952e44a7691a3_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:32
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
8d9458f52fd52c9e0663438a3a9615fc

SHA1
06a486e40342c9e2d5bf24849c5c411a81d7a3dc

SHA256
b7458cb1073cb04591cf4355332cd4e304e4fe1bf04fd841a8235833a0f1cabb

SHA512
4cb05ec21cfd8113cf771acce637fb03569009745c24b4995358371494f4f0974662e851b5e4140dda2965cd1a1314cfb8bc60b1e39aff17e83cbf027aeb127a

Download Submit
memory/32-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/32-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/32-2-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/32-3-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/32-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2032-19-0x0000000000640000-0x0000000000646000-memory.dmp

Filesize
24KB

Download
memory/2032-21-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/2032-52-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download