14546dd3f82cee78280c24b7ba5c3ed37ace0f2177eae3ef01bd609d1d688688

Analysis

max time kernel
150s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 08:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe
Size

49KB
MD5

3cd104fcbdaa90f4349317e84d5a2beb
SHA1

7dd17d42ac4ad7d121aa36d6d265d28285a9331f
SHA256

14546dd3f82cee78280c24b7ba5c3ed37ace0f2177eae3ef01bd609d1d688688
SHA512

e3d85a652e691dc98a183151196ac6f49abf9a179a695afb217b27bdaf1ea0832a973f5c82b4da1a75dd0af0b81f003d85e2dd82275b20c0d91a91595f10588d
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr46xdUUuuMT8MWAN:vj+jsMQMOtEvwDpj5Hczer5ixuMbWAN

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001db2a-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000001db2a-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3928	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3928	3484	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe	96
PID 3484 wrote to memory of 3928	3484	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe	96
PID 3484 wrote to memory of 3928	3484	2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe	96

C:\Users\Admin\AppData\Local\Temp\2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_3cd104fcbdaa90f4349317e84d5a2beb_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3492 --field-trial-handle=2280,i,8281149332300504990,9122875031903898779,262144 --variations-seed-version /prefetch:8
1⤵
PID:3468

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
49KB

MD5
7fe27cd501a45ed94155b10f87ab70b9

SHA1
523aa6b48f0958fca1ce0790facfa92f4f577cbe

SHA256
ce85fb88eccd9d694e0a13e7037a16dbafe841ab6a66c7277efd637cebe9a885

SHA512
b47e80454a9b11cb3f96057fbbffd05fe71a122dbd583ab85ccef073ede0d7770c99d3782c99d1e5d39eb1016e6a17c678a7adebf9299a9b124ee41bd5b36c3a

Download Submit
memory/3484-0-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/3484-1-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/3484-2-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/3928-17-0x0000000000820000-0x0000000000826000-memory.dmp

Filesize
24KB

Download
memory/3928-18-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download