4bf183bf6f8024ecef239018b6a6171903890d3dc987717ff83aff3cd4aadc56

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
07/03/2024, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-07_d6a7d0c8da8476704ed2105d712f2385_cryptolocker.exe
Size

53KB
MD5

d6a7d0c8da8476704ed2105d712f2385
SHA1

bc983a0054127ea673c9ae77ad8e9882f2b6ad62
SHA256

4bf183bf6f8024ecef239018b6a6171903890d3dc987717ff83aff3cd4aadc56
SHA512

df3b2b580d7f3cb38a9c1b5d8b1b50700d9a70f0fa68c7d6fd2806131a9b3e4d8bb02cfb2a4b46129dd21c572e850466a608797f86c86f385f7c98c4ad891cf7
SSDEEP

1536:ZzFbxmLPWQMOtEvwDpj386Sj/WprgJN6tZdO58O:ZVxkGOtEvwDpjcV

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001e980-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	2024-03-07_d6a7d0c8da8476704ed2105d712f2385_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3100	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 3100	4908	2024-03-07_d6a7d0c8da8476704ed2105d712f2385_cryptolocker.exe	87
PID 4908 wrote to memory of 3100	4908	2024-03-07_d6a7d0c8da8476704ed2105d712f2385_cryptolocker.exe	87
PID 4908 wrote to memory of 3100	4908	2024-03-07_d6a7d0c8da8476704ed2105d712f2385_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-03-07_d6a7d0c8da8476704ed2105d712f2385_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-07_d6a7d0c8da8476704ed2105d712f2385_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
54KB

MD5
bf6c3037e7e150282b75cdde56ef6c24

SHA1
1a9b45001414c77218604c3b186e819af4b27ea2

SHA256
5a50dea93c32f4c42521603783d12cad11b3e08bf00a9a6212930b5619e0a7cd

SHA512
e9a60041eb710ed6296e6b338cc60430b2ee633ce84a9987b4550d406b7fa9491a91cb546ab04a380191c4902740659f360c697b6e9c0afce33aa241c6d5094f

Download Submit
memory/3100-19-0x0000000002070000-0x0000000002076000-memory.dmp

Filesize
24KB

Download
memory/3100-21-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/4908-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download
memory/4908-1-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/4908-2-0x00000000006E0000-0x00000000006E6000-memory.dmp

Filesize
24KB

Download
memory/4908-3-0x0000000000890000-0x0000000000896000-memory.dmp

Filesize
24KB

Download
memory/4908-17-0x00000000004E0000-0x00000000004E3000-memory.dmp

Filesize
12KB

Download