0b75ab57a9dc0e397ff2cce783cb8628ff68a9a241978598d4a85098b3bda5e2

Analysis

max time kernel
161s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 20:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe
Size

87KB
MD5

73563319660481bd66bca2cd855ce9d1
SHA1

ccc6978dcab79b2072b94d8d09b5e723e8cf1a80
SHA256

0b75ab57a9dc0e397ff2cce783cb8628ff68a9a241978598d4a85098b3bda5e2
SHA512

a8eddc33f957bcec37a438feddac51028601b7f5f321796809e7eb1460ca61de292d32c3904346ba510762d6f5baf9a3c4a3cad7151fa9e75b58de3dd4c6001c
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvxgn3:i5nkFGMOtEvwDpjNbwQEI8UtzNcO8y3

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/1512-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0004000000022747-13.dat	CryptoLocker_rule2
behavioral2/memory/1512-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1056-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/memory/1512-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/1056-26-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral2/memory/1512-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0004000000022747-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1512-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1056-26-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2727153400-192325109-1870347593-1000\Control Panel\International\Geo\Nation	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1056	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1512 wrote to memory of 1056	1512	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe	92
PID 1512 wrote to memory of 1056	1512	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe	92
PID 1512 wrote to memory of 1056	1512	2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-13_73563319660481bd66bca2cd855ce9d1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1512
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
87KB

MD5
f80079a811c7735e8a02afad74bfb95d

SHA1
3da1afa90d08a48a58a1b68b37f8416a7d91c190

SHA256
e73492efc471787e19f16db8d2e31251564278293820685396faed49b57f14a5

SHA512
fcc3f7c7eefbd989745dac15b5b019ea60cf38c5ef7ef920f508cb4568e0507c274887895138696fbf24f03ee81f17be3be08d521b0884d311f79266da3133e3

Download Submit
memory/1056-19-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download
memory/1056-22-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/1056-26-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1512-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/1512-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1512-2-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1512-3-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/1512-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download