ca0936a11e27bb2b82b9f6862401c475e702827b15afc341048afc426b0b7403

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 04:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-12_4f197fef9e91e3ba8246711978d2eebf_cryptolocker.exe
Size

64KB
MD5

4f197fef9e91e3ba8246711978d2eebf
SHA1

e54d462c602b0b9412d53b8c45225a84678ca6fc
SHA256

ca0936a11e27bb2b82b9f6862401c475e702827b15afc341048afc426b0b7403
SHA512

272db51f77d1344dcd2526d460d62be8edf2f421327cc3c4d0ea50232e87181e9f323ded25ad174b38b092b82bff2b48204729c0a3b4f0b9b0c9db5bdf2bf50f
SSDEEP

768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEMoy:6j+1NMOtEvwDpjr8ox8UDEhy

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/4576-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0007000000023201-13.dat	CryptoLocker_rule2
behavioral2/files/0x0007000000023201-15.dat	CryptoLocker_rule2
behavioral2/memory/4576-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/3756-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral2/memory/4576-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0007000000023201-13.dat	CryptoLocker_set1
behavioral2/files/0x0007000000023201-15.dat	CryptoLocker_set1
behavioral2/memory/4576-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/3756-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/4576-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023201-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0007000000023201-15.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4576-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/3756-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	2024-03-12_4f197fef9e91e3ba8246711978d2eebf_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3756	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 3756	4576	2024-03-12_4f197fef9e91e3ba8246711978d2eebf_cryptolocker.exe	88
PID 4576 wrote to memory of 3756	4576	2024-03-12_4f197fef9e91e3ba8246711978d2eebf_cryptolocker.exe	88
PID 4576 wrote to memory of 3756	4576	2024-03-12_4f197fef9e91e3ba8246711978d2eebf_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-03-12_4f197fef9e91e3ba8246711978d2eebf_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-12_4f197fef9e91e3ba8246711978d2eebf_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
44KB

MD5
f89eb9a82ef5732fde5d6174a0149087

SHA1
aae354938ef51ff662b326dabf5202c36838febd

SHA256
cedae324c630c1bd7ae22df26ef49b1d48eeb87e436189773ea875d3b923c342

SHA512
33ba160c92b347b9b82a138c1a6b27497e537eaefa6a6dc4e619b3a86290bba918ba8cb508a888e571d03003346dcf2b0aafdf85754a814e8fe7fd376445a4fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
64KB

MD5
391410a950077a4b1b3647a7b5d88709

SHA1
eb9c9ee76972dbca2b8a8532b14fe33883f4e097

SHA256
87f9a3e6299c17182a31386eb5ca4039ef5976710329099cf9d0ff6fda2d6f53

SHA512
ca533acb62c4969d6cf83d355aac4cc96351c01276d0f6694562530c042797628c4b7788238c61c7d3fee06fff089c7f0f1b0e339284cde2c0a2db86c06a0674

Download Submit
memory/3756-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3756-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3756-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4576-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/4576-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4576-2-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4576-3-0x00000000020F0000-0x00000000020F6000-memory.dmp

Filesize
24KB

Download
memory/4576-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download