d5351d7c992196905a44dd686b1baee2ebe468d6c21c3af9dd5d01db200ed9c9

Analysis

max time kernel
92s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 10:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-09_701afddfb788354ebada3c9871094ec9_cryptolocker.exe
Size

47KB
MD5

701afddfb788354ebada3c9871094ec9
SHA1

bcd9d58364f336709dcae3971742f1420acfc541
SHA256

d5351d7c992196905a44dd686b1baee2ebe468d6c21c3af9dd5d01db200ed9c9
SHA512

4d957165a9b840cb90abf424ecc0e0177bae44d740edd4efcb8f3dc53ebae621a9a8d7a5fb2bacca0f90105a3cc1ff85063a2035f0021cdf8312d13681f753d7
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaRN6:xj+VGMOtEvwDpjy+TRN6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4808-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0008000000023206-13.dat	CryptoLocker_rule2
behavioral2/memory/4808-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2020-59-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/4808-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0008000000023206-13.dat	CryptoLocker_set1
behavioral2/memory/4808-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2020-59-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral2/memory/4808-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x0008000000023206-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4808-17-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2020-59-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	2024-04-09_701afddfb788354ebada3c9871094ec9_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-983155329-280873152-1838004294-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
2020	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2020	4808	2024-04-09_701afddfb788354ebada3c9871094ec9_cryptolocker.exe	88
PID 4808 wrote to memory of 2020	4808	2024-04-09_701afddfb788354ebada3c9871094ec9_cryptolocker.exe	88
PID 4808 wrote to memory of 2020	4808	2024-04-09_701afddfb788354ebada3c9871094ec9_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-04-09_701afddfb788354ebada3c9871094ec9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_701afddfb788354ebada3c9871094ec9_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
48KB

MD5
57ae03b0fdb4db1754e2b97bd70ab078

SHA1
1cfb2c9eb53b7d8c3137c2eaec7bb4f1edd3a856

SHA256
c2241b13f0d5690feebbe65d4fc049cadf070a288e51cd0a942b51494d9f6757

SHA512
0a308b69f518c906f28504b7debf3f847e6cdb59e453b17136d01aba797bb2ed33444368441ac5fa45ef0a69f73acbe7107cebd5daa30878b5bb6193466ae4fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
1KB

MD5
c53498ab72c6a3f1157d489964888b83

SHA1
e6ac70e6ccf49ba78d527290c57302deaa99035c

SHA256
4ffeab9d5e853c769f71f26e266598ffa6d5f8d4d2c12edb565e838b2cf3be36

SHA512
92de46ed1694f273c03b912c3806d8185e7e20211d56cd598b9f92d505612c514f3cc376ea200424fef3d81226237bf7220adece0a268f3f5e4a1b3f0ce6dd85

Download Submit
memory/2020-19-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

Filesize
24KB

Download
memory/2020-20-0x0000000000840000-0x0000000000846000-memory.dmp

Filesize
24KB

Download
memory/2020-59-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4808-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4808-1-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/4808-2-0x0000000000560000-0x0000000000566000-memory.dmp

Filesize
24KB

Download
memory/4808-3-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/4808-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download