399af57b3fc52d765bbe4641663184861cf6d99c98daf0a54893445252b3f332

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 00:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-29_ecb8eb07638fdc507a48be48fd7598c2_cryptolocker.exe
Size

65KB
MD5

ecb8eb07638fdc507a48be48fd7598c2
SHA1

fd42b474100d4b4cc8a68b7108ad9d3dc2f4ee31
SHA256

399af57b3fc52d765bbe4641663184861cf6d99c98daf0a54893445252b3f332
SHA512

c97da6e159a7564e97bf8a61ae208465c07af6a652d73b2560d45b61ce757a800294be5d96b79c5b0103171478141b52f4dea03d403cc26156e8bfe3d28d1370
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUI2:i5nkFGMOtEvwDpjNbwQEI8Un

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/3468-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000800000002322b-13.dat	CryptoLocker_rule2
behavioral2/memory/3468-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3564-52-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/memory/3468-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3564-52-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral2/memory/3468-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000800000002322b-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3468-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3564-52-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	2024-02-29_ecb8eb07638fdc507a48be48fd7598c2_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
3564	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 3564	3468	2024-02-29_ecb8eb07638fdc507a48be48fd7598c2_cryptolocker.exe	90
PID 3468 wrote to memory of 3564	3468	2024-02-29_ecb8eb07638fdc507a48be48fd7598c2_cryptolocker.exe	90
PID 3468 wrote to memory of 3564	3468	2024-02-29_ecb8eb07638fdc507a48be48fd7598c2_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-02-29_ecb8eb07638fdc507a48be48fd7598c2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-29_ecb8eb07638fdc507a48be48fd7598c2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
65KB

MD5
5044eb54519cf947c6ded90ac94abecf

SHA1
8aff3171b60762134beae30dc036e377307c2313

SHA256
82c1c06e62b810aaf7f0a2996f600f72a3c0e9cd1d74c3c96291549d7ea55082

SHA512
e0a67de59078438b09c5d65a0b21ac2cd5876ffd559d6b063cc71af08d455b1d3b3dab55d34778c63c90935aed13adfd95837bd9ba3232a5d24cde0e383ddbe9

Download Submit
memory/3468-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3468-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3468-2-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/3468-3-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/3468-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/3564-19-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/3564-22-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/3564-52-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download