62ab4d0ce4f081b07780e320be35103340327ca684b3a03eb0d51047d9e4a34a

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09-03-2024 02:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe
Size

55KB
MD5

0d1d3c8d3ba1ea486287073c689b39d8
SHA1

a283257f1485ce1aeca3b2f2c52da7b0afe57693
SHA256

62ab4d0ce4f081b07780e320be35103340327ca684b3a03eb0d51047d9e4a34a
SHA512

48b0892628eb06a2c2b8ecb2b4734931ae55f01cebfad346d8bffbfe1855e65dd555c5b2ff155b35879340fb15423a853a1509d06ab2817cfefe7be4a44f1a10
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4hdCW1nw71TkhsiPn1YFv6dlr:vj+jsMQMOtEvwDpj5HH1nw73KOFir

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e9a0-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e9a0-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
208	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3688 wrote to memory of 208	3688	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe	89
PID 3688 wrote to memory of 208	3688	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe	89
PID 3688 wrote to memory of 208	3688	2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-09_0d1d3c8d3ba1ea486287073c689b39d8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3688
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:208

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
55KB

MD5
64675db51f3202e26296ea4af80472cc

SHA1
e607b92c6c42157b8153c8af5419f027553a5367

SHA256
a075e47c833ba714d1d333d51e195ed223f27851c8891b119281196c7d735c1e

SHA512
e950da3077bfa8a67d0092500a0fe69d7743b7bb5d9487527af8dfa08a7bfdc944f1ebf14d3a2c1ba80da43f99fe3e47ea906c72d1b36cd4baeeae409512ca4f

Download Submit
memory/208-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/208-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3688-0-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3688-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/3688-2-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download