fb295cc4bf1e3897bc1b93c4bd3c573071816f57cd741d7836b3b7f9efae268c

Analysis

max time kernel
185s
max time network
209s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/03/2024, 02:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe
Size

61KB
MD5

31bbf383d9dc191e069f649ccce47e91
SHA1

48fbf2577174154eec91b6b6281385b495bda62f
SHA256

fb295cc4bf1e3897bc1b93c4bd3c573071816f57cd741d7836b3b7f9efae268c
SHA512

dc510552b7b0ebc63735f59bf0c12f0413a835bc4f5ee017277b93f1a297f6f5594a3eed088b6c40efc3f2ab034a19d1b82eeac5a75e275fd5545a9141f17e85
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTI4:TCjsIOtEvwDpj5HE/OUHnSMS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/1112-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x00050000000224ff-13.dat	CryptoLocker_rule2
behavioral2/memory/4864-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1112-19-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4864-27-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral2/memory/1112-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x00050000000224ff-13.dat	CryptoLocker_set1
behavioral2/memory/4864-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/1112-19-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4864-27-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4864	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4864	1112	2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe	93
PID 1112 wrote to memory of 4864	1112	2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe	93
PID 1112 wrote to memory of 4864	1112	2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-10_31bbf383d9dc191e069f649ccce47e91_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
5d66bc37aa4d01f6dad7bde136fc2d00

SHA1
f960effa269f272fe189b25a9cb4d6f7ab01eabf

SHA256
eb7d23492b34afde8ff67fa943eb3b743e1057b6bc806da324da4183b71447cc

SHA512
c5e2262faa2d094484059dfa8b4364b53786e33e3d40c5b96ced2de76bd0b4ec630ac8a4d6bee8e309a7dfcff67c8749bcc2820195cc46ee0c63c88a2fd8f329

Download Submit
memory/1112-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1112-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/1112-2-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/1112-3-0x0000000000550000-0x0000000000556000-memory.dmp

Filesize
24KB

Download
memory/1112-19-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4864-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4864-22-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/4864-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4864-27-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download