39777f3f33863c0f6de693d9d1e9027da5b517d371b17b6d2e60888e51269b23

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_e9241eb7b30c4cd4208b06e6f6fb1bf6_cryptolocker.exe
Size

77KB
MD5

e9241eb7b30c4cd4208b06e6f6fb1bf6
SHA1

da0cb72bf2c16e673ace471d71345cbaeac194d5
SHA256

39777f3f33863c0f6de693d9d1e9027da5b517d371b17b6d2e60888e51269b23
SHA512

7644b052ea536502d8dc6c56766d1e1f7f505ee3ab2c0f0bb68640f78eb869d0c50a265e8b3ded1334a14dc5f5cebf60d14204657dd6c5d45db69af1bbe58eb9
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIufLV:vCjsIOtEvwDpj5H9YvQd2N

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023124-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000f000000023124-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-03-09_e9241eb7b30c4cd4208b06e6f6fb1bf6_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3736	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2280 wrote to memory of 3736	2280	2024-03-09_e9241eb7b30c4cd4208b06e6f6fb1bf6_cryptolocker.exe	85
PID 2280 wrote to memory of 3736	2280	2024-03-09_e9241eb7b30c4cd4208b06e6f6fb1bf6_cryptolocker.exe	85
PID 2280 wrote to memory of 3736	2280	2024-03-09_e9241eb7b30c4cd4208b06e6f6fb1bf6_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-03-09_e9241eb7b30c4cd4208b06e6f6fb1bf6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_e9241eb7b30c4cd4208b06e6f6fb1bf6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2280
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
77KB

MD5
6beea039cbaac66e5664575cfcb60033

SHA1
51fa99de1a7bf4a34b73b6863f7cfd35482b0004

SHA256
9bfc7662ddcb845cf2626151728f91177821e193887da62473bc8a3d7daf6a0f

SHA512
9809ee261474fe00d52efd8249b16f20e681b719d0ad46832c7d2a0af2e31cadadbbad7571e47354b896504e4f28dd6e57da43e1b06bea56f7673f73eabd2d8b

Download Submit
memory/2280-0-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/2280-1-0x00000000020D0000-0x00000000020D6000-memory.dmp

Filesize
24KB

Download
memory/2280-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/3736-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3736-23-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download