Analysis
-
max time kernel
114s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
29/03/2024, 17:56 UTC
General
-
Target
2024-03-29_bfb12bc505ca7736641758ac7b36758b_cryptolocker.exe
-
Size
64KB
-
MD5
bfb12bc505ca7736641758ac7b36758b
-
SHA1
40386403a0552097580e60ceb22506c92d24d65e
-
SHA256
12dd746c4fb22315953508e7e85a0702c088607682e8da266f41379dc7d46e71
-
SHA512
72e8dc462484cc7579a573148c0eeb837fae61d89883ed5bb796b0d51c429e5cdd3c579db04aea3984194e7bfbb286a82cd3e09375723ad5fa9b29509b511df3
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEMpf:6j+1NMOtEvwDpjr8ox8UDEI
Score
9/10
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies system certificate store 2 TTPs 8 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-29_bfb12bc505ca7736641758ac7b36758b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-29_bfb12bc505ca7736641758ac7b36758b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Modifies system certificate store
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4484 --field-trial-handle=2272,i,17338911640954948469,1637568328132129119,262144 --variations-seed-version /prefetch:81⤵
Network
-
DNS217.106.137.52.in-addr.arpaRemote address:8.8.8.8:53Request217.106.137.52.in-addr.arpaIN PTRResponse -
DNS41.134.221.88.in-addr.arpaRemote address:8.8.8.8:53Request41.134.221.88.in-addr.arpaIN PTRResponse41.134.221.88.in-addr.arpaIN PTRa88-221-134-41deploystaticakamaitechnologiescom
-
DNSbestccc.comRemote address:8.8.8.8:53Requestbestccc.comIN AResponsebestccc.comIN A103.14.121.240
-
GEThttps://bestccc.com/hr/ho2.exeRemote address:103.14.121.240:443RequestGET /hr/ho2.exe HTTP/1.1
Accept: text/*, application/*
User-Agent: Updates downloader
Host: bestccc.com
Cache-Control: no-cache
ResponseHTTP/1.1 404 Not Found
Date: Fri, 29 Mar 2024 17:55:46 GMT
Server: Apache/2
Content-Length: 315
Content-Type: text/html; charset=iso-8859-1
-
DNScrl.comodoca.comRemote address:8.8.8.8:53Requestcrl.comodoca.comIN AResponsecrl.comodoca.comIN CNAMEcrl.comodoca.com.cdn.cloudflare.netcrl.comodoca.com.cdn.cloudflare.netIN A172.64.149.23crl.comodoca.com.cdn.cloudflare.netIN A104.18.38.233
-
GEThttp://crl.comodoca.com/cPanelIncCertificationAuthority.crlRemote address:172.64.149.23:80RequestGET /cPanelIncCertificationAuthority.crl HTTP/1.1
Connection: Keep-Alive
Accept: */*
User-Agent: Microsoft-CryptoAPI/10.0
Host: crl.comodoca.com
ResponseHTTP/1.1 200 OK
Date: Fri, 29 Mar 2024 17:57:06 GMT
Content-Type: application/pkix-crl
Content-Length: 62039
Connection: keep-alive
Last-Modified: Fri, 29 Mar 2024 07:15:18 GMT
Expires: Fri, 05 Apr 2024 07:15:18 GMT
Etag: "8aef5893a69360fbf48aa7a74985d66523a4a2dc"
Cache-Control: max-age=600425,s-maxage=3600,public,no-transform,must-revalidate
X-CCACDN-Proxy-ID: mcdpinlb2
X-Frame-Options: SAMEORIGIN
CF-Cache-Status: HIT
Age: 2970
Accept-Ranges: bytes
Server: cloudflare
CF-RAY: 86c1bd899b6e63c0-LHR
-
DNS240.121.14.103.in-addr.arpaRemote address:8.8.8.8:53Request240.121.14.103.in-addr.arpaIN PTRResponse240.121.14.103.in-addr.arpaIN PTR10314121240-static-reversegooddomainregistrycom
-
DNS23.159.190.20.in-addr.arpaRemote address:8.8.8.8:53Request23.159.190.20.in-addr.arpaIN PTRResponse
-
DNS218.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request218.135.221.88.in-addr.arpaIN PTRResponse218.135.221.88.in-addr.arpaIN PTRa88-221-135-218deploystaticakamaitechnologiescom
-
DNS233.38.18.104.in-addr.arpaRemote address:8.8.8.8:53Request233.38.18.104.in-addr.arpaIN PTRResponse
-
DNS23.149.64.172.in-addr.arpaRemote address:8.8.8.8:53Request23.149.64.172.in-addr.arpaIN PTRResponse
-
DNS104.219.191.52.in-addr.arpaRemote address:8.8.8.8:53Request104.219.191.52.in-addr.arpaIN PTRResponse
-
DNS196.249.167.52.in-addr.arpaRemote address:8.8.8.8:53Request196.249.167.52.in-addr.arpaIN PTRResponse
-
DNS43.229.111.52.in-addr.arpaRemote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
DNS26.165.165.52.in-addr.arpaRemote address:8.8.8.8:53Request26.165.165.52.in-addr.arpaIN PTRResponse
-
DNS15.164.165.52.in-addr.arpaRemote address:8.8.8.8:53Request15.164.165.52.in-addr.arpaIN PTRResponse
-
DNS217.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request217.135.221.88.in-addr.arpaIN PTRResponse217.135.221.88.in-addr.arpaIN PTRa88-221-135-217deploystaticakamaitechnologiescom
-
DNSchromewebstore.googleapis.comRemote address:8.8.8.8:53Requestchromewebstore.googleapis.comIN AResponsechromewebstore.googleapis.comIN A142.250.185.106chromewebstore.googleapis.comIN A142.250.185.138chromewebstore.googleapis.comIN A142.250.185.170chromewebstore.googleapis.comIN A142.250.185.202chromewebstore.googleapis.comIN A142.250.185.234chromewebstore.googleapis.comIN A142.250.184.234chromewebstore.googleapis.comIN A216.58.206.74chromewebstore.googleapis.comIN A142.250.181.234chromewebstore.googleapis.comIN A142.250.186.42chromewebstore.googleapis.comIN A142.250.186.74chromewebstore.googleapis.comIN A172.217.16.138chromewebstore.googleapis.comIN A216.58.212.170chromewebstore.googleapis.comIN A142.250.74.202chromewebstore.googleapis.comIN A142.250.184.202chromewebstore.googleapis.comIN A172.217.18.10chromewebstore.googleapis.comIN A142.250.186.106
-
DNSchromewebstore.googleapis.comRemote address:8.8.8.8:53Requestchromewebstore.googleapis.comIN UnknownResponse
-
DNSpki.googRemote address:8.8.8.8:53Requestpki.googIN AResponsepki.googIN A216.239.32.29
-
DNSpki.googRemote address:8.8.8.8:53Requestpki.googIN UnknownResponse
-
GEThttp://pki.goog/gsr1/gsr1.crtRemote address:216.239.32.29:80RequestGET /gsr1/gsr1.crt HTTP/1.1
Host: pki.goog
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 797
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 29 Mar 2024 17:16:50 GMT
Expires: Fri, 29 Mar 2024 18:06:50 GMT
Cache-Control: public, max-age=3000
Age: 2447
Last-Modified: Wed, 20 May 2020 16:45:00 GMT
Content-Type: application/pkix-cert
Vary: Accept-Encoding
-
GEThttp://pki.goog/repo/certs/gtsr1.derRemote address:216.239.32.29:80RequestGET /repo/certs/gtsr1.der HTTP/1.1
Host: pki.goog
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 1371
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 29 Mar 2024 17:55:28 GMT
Expires: Fri, 29 Mar 2024 18:45:28 GMT
Cache-Control: public, max-age=3000
Age: 129
Last-Modified: Sun, 25 Jun 2023 02:58:00 GMT
Content-Type: application/pkix-cert
Vary: Accept-Encoding
-
GEThttp://pki.goog/repo/certs/gts1c3.derRemote address:216.239.32.29:80RequestGET /repo/certs/gts1c3.der HTTP/1.1
Host: pki.goog
Connection: keep-alive
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
ResponseHTTP/1.1 200 OK
Accept-Ranges: bytes
Content-Encoding: gzip
Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
Cross-Origin-Resource-Policy: cross-origin
Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
Content-Length: 1304
X-Content-Type-Options: nosniff
Server: sffe
X-XSS-Protection: 0
Date: Fri, 29 Mar 2024 17:07:55 GMT
Expires: Fri, 29 Mar 2024 17:57:55 GMT
Cache-Control: public, max-age=3000
Age: 2982
Last-Modified: Mon, 17 Aug 2020 09:45:00 GMT
Content-Type: application/pkix-cert
Vary: Accept-Encoding
-
DNS106.185.250.142.in-addr.arpaRemote address:8.8.8.8:53Request106.185.250.142.in-addr.arpaIN PTRResponse106.185.250.142.in-addr.arpaIN PTRfra16s49-in-f101e100net
-
DNS29.32.239.216.in-addr.arpaRemote address:8.8.8.8:53Request29.32.239.216.in-addr.arpaIN PTRResponse29.32.239.216.in-addr.arpaIN PTRany-in-201d1e100net
-
DNS219.135.221.88.in-addr.arpaRemote address:8.8.8.8:53Request219.135.221.88.in-addr.arpaIN PTRResponse219.135.221.88.in-addr.arpaIN PTRa88-221-135-219deploystaticakamaitechnologiescom
-
20.231.121.79:80
-
103.14.121.240:443https://bestccc.com/hr/ho2.exetls, http
HTTP Request
GET https://bestccc.com/hr/ho2.exeHTTP Response
404 -
172.64.149.23:80http://crl.comodoca.com/cPanelIncCertificationAuthority.crlhttp
HTTP Request
GET http://crl.comodoca.com/cPanelIncCertificationAuthority.crlHTTP Response
200 -
13.107.246.64:443
-
142.250.185.106:443chromewebstore.googleapis.comtls -
216.239.32.29:80http://pki.goog/repo/certs/gts1c3.derhttp
HTTP Request
GET http://pki.goog/gsr1/gsr1.crtHTTP Response
200HTTP Request
GET http://pki.goog/repo/certs/gtsr1.derHTTP Response
200HTTP Request
GET http://pki.goog/repo/certs/gts1c3.derHTTP Response
200
-
8.8.8.8:53217.106.137.52.in-addr.arpadns
DNS Request
217.106.137.52.in-addr.arpa
-
8.8.8.8:5341.134.221.88.in-addr.arpadns
DNS Request
41.134.221.88.in-addr.arpa
-
8.8.8.8:53bestccc.comdns
DNS Request
bestccc.com
DNS Response
103.14.121.240
-
8.8.8.8:53crl.comodoca.comdns
DNS Request
crl.comodoca.com
DNS Response
172.64.149.23104.18.38.233
-
8.8.8.8:53240.121.14.103.in-addr.arpadns
DNS Request
240.121.14.103.in-addr.arpa
-
8.8.8.8:5323.159.190.20.in-addr.arpadns
DNS Request
23.159.190.20.in-addr.arpa
-
8.8.8.8:53218.135.221.88.in-addr.arpadns
DNS Request
218.135.221.88.in-addr.arpa
-
8.8.8.8:53233.38.18.104.in-addr.arpadns
DNS Request
233.38.18.104.in-addr.arpa
-
8.8.8.8:5323.149.64.172.in-addr.arpadns
DNS Request
23.149.64.172.in-addr.arpa
-
8.8.8.8:53104.219.191.52.in-addr.arpadns
DNS Request
104.219.191.52.in-addr.arpa
-
8.8.8.8:53196.249.167.52.in-addr.arpadns
DNS Request
196.249.167.52.in-addr.arpa
-
8.8.8.8:5343.229.111.52.in-addr.arpadns
DNS Request
43.229.111.52.in-addr.arpa
-
8.8.8.8:5326.165.165.52.in-addr.arpadns
DNS Request
26.165.165.52.in-addr.arpa
-
8.8.8.8:5315.164.165.52.in-addr.arpadns
DNS Request
15.164.165.52.in-addr.arpa
-
8.8.8.8:53217.135.221.88.in-addr.arpadns
DNS Request
217.135.221.88.in-addr.arpa
-
8.8.8.8:53chromewebstore.googleapis.comdns
DNS Request
chromewebstore.googleapis.com
DNS Response
142.250.185.106142.250.185.138142.250.185.170142.250.185.202142.250.185.234142.250.184.234216.58.206.74142.250.181.234142.250.186.42142.250.186.74172.217.16.138216.58.212.170142.250.74.202142.250.184.202172.217.18.10142.250.186.106
-
8.8.8.8:53chromewebstore.googleapis.comdns
DNS Request
chromewebstore.googleapis.com
-
8.8.8.8:53pki.googdns
DNS Request
pki.goog
DNS Response
216.239.32.29
-
8.8.8.8:53pki.googdns
DNS Request
pki.goog
-
8.8.8.8:53106.185.250.142.in-addr.arpadns
DNS Request
106.185.250.142.in-addr.arpa
-
8.8.8.8:5329.32.239.216.in-addr.arpadns
DNS Request
29.32.239.216.in-addr.arpa
-
8.8.8.8:53219.135.221.88.in-addr.arpadns
DNS Request
219.135.221.88.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5d6669ac16d0906a3749e3f9579686295
SHA1ad46c28f2ab888c806b39f3c215b74b24a9e61e2
SHA256dd7082697e9f668608062fe6a2f57340899afef87d1003134659974f309afb49
SHA5124e7651402ef1a48a173e12bacbdbe3e91d6ad804b4ff64f11c67cacb818403b7f8d7f4971b5aee6ef7cacff7a848130a064ad3810606b30747059bfd86efe487
-
Filesize
315B
MD5a34ac19f4afae63adc5d2f7bc970c07f
SHA1a82190fc530c265aa40a045c21770d967f4767b8
SHA256d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3
SHA51242e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB