77c7bcc443c910aea4dc9d4b569daaec3f1da551a804a410b3bcc538b21a8bb2

Analysis

max time kernel
158s
max time network
185s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 23:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_63fa510b621a80606c520281c0e8e6df_cryptolocker.exe
Size

120KB
MD5

63fa510b621a80606c520281c0e8e6df
SHA1

b778fcc68637f10580a4991c33926a0e520b6015
SHA256

77c7bcc443c910aea4dc9d4b569daaec3f1da551a804a410b3bcc538b21a8bb2
SHA512

adce8221071e5d47fddaf0539f833cddbae77cedbb1048278210360a2ce6da89c9a5be10a1609044f2dc13b9fe1106e24e08bc473e7c32d53c376a5921bb9a9a
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUSpp:vCjsIOtEvwDpj5H9YvQd2o

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001e806-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001e806-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-609813121-2907144057-1731107329-1000\Control Panel\International\Geo\Nation	2024-03-15_63fa510b621a80606c520281c0e8e6df_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3352	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 3352	1976	2024-03-15_63fa510b621a80606c520281c0e8e6df_cryptolocker.exe	92
PID 1976 wrote to memory of 3352	1976	2024-03-15_63fa510b621a80606c520281c0e8e6df_cryptolocker.exe	92
PID 1976 wrote to memory of 3352	1976	2024-03-15_63fa510b621a80606c520281c0e8e6df_cryptolocker.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-03-15_63fa510b621a80606c520281c0e8e6df_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_63fa510b621a80606c520281c0e8e6df_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
120KB

MD5
aa6402f12b42f999d072f6f40b3e465b

SHA1
8d34bb438ec8134c51c6682a3a86ff404147c470

SHA256
1f91fe91fd13d45e286a9163a5306f5f154d9ab0b3e0b920a6048dbea1a3a705

SHA512
80db1bb62a0df5355b71aa1df8624ccd1805e256861dbf6ce80a2157a154c9c26cec9058118804b56c2411bbfef7705bbccb939cd98bd8fed7e6b1ebc6db38af

Download Submit
memory/1976-0-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1976-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1976-2-0x0000000000710000-0x0000000000716000-memory.dmp

Filesize
24KB

Download
memory/3352-17-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/3352-19-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download