d681fc4cd548c04ea9d5c876c5305a87c0a24e2e62715a7b1aadde608287a519

Analysis

max time kernel
147s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
28/02/2024, 13:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_2a4476c3e0197d5832bba1c31389cde8_cryptolocker.exe
Size

52KB
MD5

2a4476c3e0197d5832bba1c31389cde8
SHA1

ff24a63651be3fa112e189a79172ec6eefad5386
SHA256

d681fc4cd548c04ea9d5c876c5305a87c0a24e2e62715a7b1aadde608287a519
SHA512

599ac18b06e74a9876ee1da9813454f5ef40ded885886538f86fee06c2ffbdeedd0f392a711de4bd80b4f221ca8c76c38aa6b3753cdfc6aa9a67a1684319abe5
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCY8EQMjpi/Wpi3B3URiLeyWI:vj+jsMQMOtEvwDpj5Hy7B3gH1I

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023225-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023225-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	2024-02-28_2a4476c3e0197d5832bba1c31389cde8_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
2096	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 2096	4892	2024-02-28_2a4476c3e0197d5832bba1c31389cde8_cryptolocker.exe	88
PID 4892 wrote to memory of 2096	4892	2024-02-28_2a4476c3e0197d5832bba1c31389cde8_cryptolocker.exe	88
PID 4892 wrote to memory of 2096	4892	2024-02-28_2a4476c3e0197d5832bba1c31389cde8_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-28_2a4476c3e0197d5832bba1c31389cde8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_2a4476c3e0197d5832bba1c31389cde8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
52KB

MD5
8993114a20fd5ac39c573c6d8ba1ccf6

SHA1
1ec97a3576e415186e54593c60214d932ede6364

SHA256
d8e067bca87e105ede245677a507e7270e395621181118ed14bca94d6a652141

SHA512
8e0c47becc08dad581ea039120bbbee9369e41dd314460a876965c01337bf16fc50c34a89c0c9ab2dbcbd20090030bed38796564b0452fb888040a6b0a54a141

Download Submit
memory/2096-17-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/2096-20-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/4892-0-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4892-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4892-2-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download