af328830a0c5d0ab96ae7f86a4ae88efd23a66a9c9314d0db48e980d60a29640

Analysis

max time kernel
149s
max time network
164s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 02:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-06_e0056f4057fb0bd969ffa2eaa2810f98_cryptolocker.exe
Size

33KB
MD5

e0056f4057fb0bd969ffa2eaa2810f98
SHA1

d07f371452120f563f7b5562dd615d0a41454bdb
SHA256

af328830a0c5d0ab96ae7f86a4ae88efd23a66a9c9314d0db48e980d60a29640
SHA512

ca0d1594fabf91a32634651ea7528fd0f26e9283e752d9cb36e30e80e90843e65a1b9a3653260528b1007f5132d2a84e3c75661ab16929af049f8cefdad41eb0
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4p:fT+hsMQMOtEvwDpjoIHp

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000226fd-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000c0000000226fd-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation	2024-03-06_e0056f4057fb0bd969ffa2eaa2810f98_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4900	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 4900	2688	2024-03-06_e0056f4057fb0bd969ffa2eaa2810f98_cryptolocker.exe	91
PID 2688 wrote to memory of 4900	2688	2024-03-06_e0056f4057fb0bd969ffa2eaa2810f98_cryptolocker.exe	91
PID 2688 wrote to memory of 4900	2688	2024-03-06_e0056f4057fb0bd969ffa2eaa2810f98_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-03-06_e0056f4057fb0bd969ffa2eaa2810f98_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-06_e0056f4057fb0bd969ffa2eaa2810f98_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
34KB

MD5
69c1a1e43c9594e32eac80447a1c8aa1

SHA1
2f7b17075923b2adcacc313119d0c7bbf9c18c3d

SHA256
26811e21eef6b6313e52b8c36aabb7a810b316491ec969f78a51c4417517f7e3

SHA512
8f1bde63e8b45ac7818a13742e64f26ee7186e2566108e57affa0877211e8cb09e0ed8b59787a212e107ccf385fa99c60bdc73f6fa17039ed840ff5dacdc5ed5

Download Submit
memory/2688-0-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2688-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/2688-2-0x0000000000610000-0x0000000000616000-memory.dmp

Filesize
24KB

Download
memory/4900-17-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/4900-19-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download