ba5c85976124ca22d81130772272c99c01f762126a983cb30f9249205804ad75

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240319-en
resource tags

arch:x64arch:x86image:win10v2004-20240319-enlocale:en-usos:windows10-2004-x64system
submitted
09-04-2024 16:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-08_3a73ab6bd75052b29da6e9f88c4f12b3_cryptolocker.exe
Size

125KB
MD5

3a73ab6bd75052b29da6e9f88c4f12b3
SHA1

20365c49eb31cf1a88ca9767eddef35dbd507490
SHA256

ba5c85976124ca22d81130772272c99c01f762126a983cb30f9249205804ad75
SHA512

540d589549a05fd95b863b973522195c4599822c10d1465145336eb29917f16c4ea4a0b91e6ecce1a938b8a27dea476fe14f8d8b82284aaeffdff359310cc530
SSDEEP

1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxE4q8:vCA9OtEvwDpjK

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001db72-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000400000001db72-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	misid.exe
Key value queried	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\International\Geo\Nation	2024-04-08_3a73ab6bd75052b29da6e9f88c4f12b3_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3644	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3644	3952	2024-04-08_3a73ab6bd75052b29da6e9f88c4f12b3_cryptolocker.exe	94
PID 3952 wrote to memory of 3644	3952	2024-04-08_3a73ab6bd75052b29da6e9f88c4f12b3_cryptolocker.exe	94
PID 3952 wrote to memory of 3644	3952	2024-04-08_3a73ab6bd75052b29da6e9f88c4f12b3_cryptolocker.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-08_3a73ab6bd75052b29da6e9f88c4f12b3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-08_3a73ab6bd75052b29da6e9f88c4f12b3_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3644

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4168 --field-trial-handle=2288,i,10301911031503898037,2997280636231771547,262144 --variations-seed-version /prefetch:8
1⤵
PID:3540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
126KB

MD5
aabeff7ac1a70d2e121d3d2df639b548

SHA1
9fce4b59246b46904cd1c67010016500c53a1394

SHA256
fcf64ecb09259b7a40c1068e00f32942daf34110c5926d6db34b6574328aab0a

SHA512
e159d049288aeac3c646b3fd5de394449da21e4ca0bf44ab973b60d778670d0525854e8e144668972a1f7bb0bee571816ccc70ea9ec884d4e8dd5935ba69400c

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
1KB

MD5
eac9b0f57a7f1697ce051e8eb83e787a

SHA1
4dd0b613d897fffdb1d9e19d0ab9a4bf7032a749

SHA256
1f5fe0e1935ffd769a27910781ad77d18400feb0503e3153ca1a8b34e9f77573

SHA512
e2cae22dd5309c4bd885e2060845682dc703e3b58de94ad21d67d742c7e0ebbc963eae0d03c2bc9b9d2aa99d097832d40e7e107613537a9b98046333a9f492ba

Download Submit
memory/3644-17-0x0000000002000000-0x0000000002006000-memory.dmp

Filesize
24KB

Download
memory/3644-19-0x00000000006C0000-0x00000000006C6000-memory.dmp

Filesize
24KB

Download
memory/3952-0-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/3952-1-0x0000000000670000-0x0000000000676000-memory.dmp

Filesize
24KB

Download
memory/3952-2-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download