9e50156b4ebd050b1d694e65330b7b50c6e5e7723305ce7790592daa5d7d3550

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29/02/2024, 06:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-29_90c5137af427b9ed4ca282666b55c960_cryptolocker.exe
Size

38KB
MD5

90c5137af427b9ed4ca282666b55c960
SHA1

c51b649d1d5b63024f27e662b09a479b334a26c7
SHA256

9e50156b4ebd050b1d694e65330b7b50c6e5e7723305ce7790592daa5d7d3550
SHA512

fa67e9518b3040dc7903e0f95ac1b940d6111ea200612d9bb6ae622aec78f8a600231a25cc56163980fb70fe5626d065b379e97a5b699cb0c8e9bbc26118ed2e
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLen7n+r:ZzFbxmLPWQMOtEvwDpjLes

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023263-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	2024-02-29_90c5137af427b9ed4ca282666b55c960_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
964	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 964	1640	2024-02-29_90c5137af427b9ed4ca282666b55c960_cryptolocker.exe	89
PID 1640 wrote to memory of 964	1640	2024-02-29_90c5137af427b9ed4ca282666b55c960_cryptolocker.exe	89
PID 1640 wrote to memory of 964	1640	2024-02-29_90c5137af427b9ed4ca282666b55c960_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-02-29_90c5137af427b9ed4ca282666b55c960_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-29_90c5137af427b9ed4ca282666b55c960_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
38KB

MD5
db2eecf40670664201495d4120039d28

SHA1
f996165b9e13fcd0aa60c4bbba9887280648f315

SHA256
6e27fcf124fe58ae196cc9a041fb3334b31dd980c608d913c99087bc1bc0b515

SHA512
aa31f0e16164d92ce759f5c17ea66e8227632aab446ff188e9805f171b91e607b6e78fe7b7e14604c79356b14815f8895f0a7c99fadceff978df159b7117da55

Download Submit
memory/964-18-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/964-21-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/964-51-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/1640-0-0x00007FFEA1F590A0-0x00007FFEA1FCCFA0-memory.dmp

Filesize
463KB

Download
memory/1640-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/1640-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/1640-3-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download