875e3434f0e0ccd5206362963af9cc7747857d91b48ddda9e9d161f1cfbfd7cd

Analysis

max time kernel
91s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 19:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-09_6e5b6d2afc58e54bc9b3f54e6148dee9_cryptolocker.exe
Size

64KB
MD5

6e5b6d2afc58e54bc9b3f54e6148dee9
SHA1

a2396ca10909f712ad120a0afde83929b884cb6b
SHA256

875e3434f0e0ccd5206362963af9cc7747857d91b48ddda9e9d161f1cfbfd7cd
SHA512

67957e2329dbedae1832eac78b83f6d119bf83017b36a34767a3f092673da0dd16589a7510ca0f31768d0bf79871e99ad447ed8bdf4b05da9ef2d37bea432a8b
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPvdfGyS:TCjsIOtEvwDpj5HE/OUHnSMY9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/1440-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x00090000000224e9-13.dat	CryptoLocker_rule2
behavioral2/memory/1440-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2304-59-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/1440-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x00090000000224e9-13.dat	CryptoLocker_set1
behavioral2/memory/1440-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2304-59-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	2024-04-09_6e5b6d2afc58e54bc9b3f54e6148dee9_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
2304	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1440 wrote to memory of 2304	1440	2024-04-09_6e5b6d2afc58e54bc9b3f54e6148dee9_cryptolocker.exe	85
PID 1440 wrote to memory of 2304	1440	2024-04-09_6e5b6d2afc58e54bc9b3f54e6148dee9_cryptolocker.exe	85
PID 1440 wrote to memory of 2304	1440	2024-04-09_6e5b6d2afc58e54bc9b3f54e6148dee9_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-09_6e5b6d2afc58e54bc9b3f54e6148dee9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-09_6e5b6d2afc58e54bc9b3f54e6148dee9_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1440
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
64KB

MD5
c6b4016fac33f4ce9dea6abc4425d935

SHA1
716db9f0330d533a255375c86f5fc16d372d7d28

SHA256
f7455bcb960bb931b9188ea91981c8c2d12bacb38ab9ad587fa811ca6c72b43f

SHA512
b56e70ca106dd759ca97ae42128a25aef701d3dd27de14c11f2ead1e718ef723e649df8e35e606788e4e8b108696a471c057ecb4e93ddf2e80fba9316ca97d51

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
1KB

MD5
a5c87106fe2ffdd96fe7e07a9129dc74

SHA1
ec1f3d8ea9608d4d0fc606a2ec92a8ff137fe599

SHA256
fabde57f8a8f613d54a490eb4b068b547fb1ad2649f25749842a9d70d64bb63a

SHA512
c74287b90ba42284dc566b7205d263213c269a62823729a166cbd8106bf128e7c5141eb9367516b4e796e461dee4723dfe42bc2826321348ef0d1be5133ebddc

Download Submit
memory/1440-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/1440-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1440-2-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/1440-3-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/1440-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2304-19-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2304-21-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2304-59-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download