2d8578a7ccc2cba49f75f531f4b3d09e1d858b86e989c5b1f52ca9fcc100d91f

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_00070e6477ac921ed162b756cb7d5849_cryptolocker.exe
Size

49KB
MD5

00070e6477ac921ed162b756cb7d5849
SHA1

1459842053cd2c82cd99d0fdccc75ae8936669ca
SHA256

2d8578a7ccc2cba49f75f531f4b3d09e1d858b86e989c5b1f52ca9fcc100d91f
SHA512

da77fbd719886c393813c6bafee282972faa00c0e3817ea10716077b429b624e235061bd2b0d2ae5331aaa809379ddb5dcbcdb3afe15b6e65e30349700e4ec69
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr46xdUUuuMT8ln:vj+jsMQMOtEvwDpj5Hczer5ixuMCn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023285-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000023285-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-04-10_00070e6477ac921ed162b756cb7d5849_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
3840	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 3840	4428	2024-04-10_00070e6477ac921ed162b756cb7d5849_cryptolocker.exe	94
PID 4428 wrote to memory of 3840	4428	2024-04-10_00070e6477ac921ed162b756cb7d5849_cryptolocker.exe	94
PID 4428 wrote to memory of 3840	4428	2024-04-10_00070e6477ac921ed162b756cb7d5849_cryptolocker.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-10_00070e6477ac921ed162b756cb7d5849_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_00070e6477ac921ed162b756cb7d5849_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
3a9871d50ae1abb9cf1a6c0502bef2ae

SHA1
a0d391689f38b987dfa21a6b6bc4127aaf86af2a

SHA256
ecf4c0051f964ec74c10a1f2655ed736d99f30554da4dc3fe0fd8a4eb71d1515

SHA512
5e42de600b29149515642306c9e3c5e597bcc570a324c367c96aff1e8a96d28c59b9fed6e5a0ba680977def1600d87e725c394649015155eaa05a25f964644fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
1KB

MD5
830d8eb640feb1b6d61c331e240c07ae

SHA1
fd1decae9472a87a56f23ac8a37ab8208e4a4d49

SHA256
8a3607a536525f44ad3b5501334c3978bf4154156b8aa280421a747221ad924b

SHA512
8678f70fc86b86054ee5d45e8d19605323af3e0ddbb7f053e8fd24ea1b112560013332e7ed9f1e89998a7fc3001410dc18abc8a51a9f7293bf76282df9cf2683

Download Submit
memory/3840-18-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download
memory/3840-17-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/4428-0-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/4428-1-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/4428-2-0x00000000021C0000-0x00000000021C6000-memory.dmp

Filesize
24KB

Download