663d7065693fd9eaa2c910190a9510eb1bd41c8732dbd3a34ba2c3b08e1213e2

Analysis

max time kernel
152s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15-03-2024 09:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe
Size

78KB
MD5

03741861a5a8df6571698df7c245c76d
SHA1

f3a92aeaa1efca3096dc4730cb72a5a2698daa28
SHA256

663d7065693fd9eaa2c910190a9510eb1bd41c8732dbd3a34ba2c3b08e1213e2
SHA512

55af579ce2c0490a30db731b894159692189f700a06d1f7746e3f33a3b85511c35142b055217f667c5414b4154fdc714e2433e275f2d590c5dae5901bf27b854
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafp:vCjsIOtEvwDpj5H9YvQd2N

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023277-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023277-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1440	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1440	1712	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe	98
PID 1712 wrote to memory of 1440	1712	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe	98
PID 1712 wrote to memory of 1440	1712	2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_03741861a5a8df6571698df7c245c76d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4340 --field-trial-handle=2252,i,16022092570067181109,3235558581947505669,262144 --variations-seed-version /prefetch:8
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
78KB

MD5
6a7dbe240bd8b77da138120cd4bb38b7

SHA1
372f7ef31fbbfda3f404efcd90041874017db84a

SHA256
fcf193f95c595fe4a216703bed7825471a10c6a627112654d5bef9faab257f51

SHA512
6d2dbc44e47882669eefecfeb21012b56cb152d0c92a5d2f8e258adfb9791af90250c60b61d0706c9cddb44c599ebce28d5d3ce1d22da1e553cdcd8fbea81d1c

Download Submit
memory/1440-17-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/1440-18-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/1712-0-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1712-1-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/1712-2-0x0000000002100000-0x0000000002106000-memory.dmp

Filesize
24KB

Download