1984c9a8baee90d64b3a2853d49835f2f5f653ab56672fef8e1484fc5a46664e

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/03/2024, 14:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe
Size

40KB
MD5

d89fef1243ef2e0acaba97e29b9dcdd6
SHA1

4a4970b377b7fe72738a244f1473d361a92f66aa
SHA256

1984c9a8baee90d64b3a2853d49835f2f5f653ab56672fef8e1484fc5a46664e
SHA512

767e92a46e41c1f7302446ce8e59681678f29f4046698c5c3e0cd22f9a7d4981bd85e548be6ff485b0fba121ed7ad6d02d3c90a0383ca69d0187cfce54e56c45
SSDEEP

768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRppts2:m5nkFNMOtEvwDpjG8hhXzzs2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/4492-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4492-11-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000900000002324b-14.dat	CryptoLocker_rule2
behavioral2/files/0x000900000002324b-16.dat	CryptoLocker_rule2
behavioral2/memory/4284-27-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/memory/4492-11-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4284-27-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/4492-0-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4492-11-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000900000002324b-14.dat	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000900000002324b-16.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4284-27-0x0000000000500000-0x000000000050E000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4284	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4492 wrote to memory of 4284	4492	2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe	98
PID 4492 wrote to memory of 4284	4492	2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe	98
PID 4492 wrote to memory of 4284	4492	2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe	98

C:\Users\Admin\AppData\Local\Temp\2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_d89fef1243ef2e0acaba97e29b9dcdd6_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4492
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4092 --field-trial-handle=2276,i,11674642242468042059,14711253743544118298,262144 --variations-seed-version /prefetch:8
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
41KB

MD5
1222957d2f1f44ca673723f164074de8

SHA1
9e7f0910e199f94301717dbc4b2a7ae3cdcbac9d

SHA256
2402b124f3ead22ad75451c12443a3499d66366b5f6817d8c92d23e12a665079

SHA512
03ff4660513f238409db140ff2b9d0946f74adaa012607cdddf7eb66ff2a3bad3c7bd79b2b28dda7517f43693910423598921a5885e1fb8f1428dd4b2c588736

Download Submit
C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
11KB

MD5
f24cf6865179eb559d1e153503192a9d

SHA1
d4f1a2fc3bf7182e79e95770409f0d04e9e75f4a

SHA256
0600411c8cb340449ca936abe29fb343a79e2260c9ab55392e132dd30671276f

SHA512
37d0f57483820a0372a46e133e518c8ead62b814921b9cfb7bb94a3c37f0e66d7e09ee050f70ea83999510476ee6c7d878563a9eb764959bf694a2f55ba31646

Download Submit
memory/4284-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

Filesize
24KB

Download
memory/4284-19-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download
memory/4284-27-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4492-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4492-1-0x00000000007C0000-0x00000000007C6000-memory.dmp

Filesize
24KB

Download
memory/4492-2-0x00000000007C0000-0x00000000007C6000-memory.dmp

Filesize
24KB

Download
memory/4492-3-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/4492-11-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download