2442a6ba3a9451d0b7a3b69494422411e239cdeca4b9af371fcfa53e6a5fa09c

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 03:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_b8784728fee3f00361bde5943e7e7b9b_cryptolocker.exe
Size

58KB
MD5

b8784728fee3f00361bde5943e7e7b9b
SHA1

aab565bdf2c117e8a2d2da09e09f289353347e22
SHA256

2442a6ba3a9451d0b7a3b69494422411e239cdeca4b9af371fcfa53e6a5fa09c
SHA512

2bb23baa785324d3578bd40e362ba38c3524cb5b1a204c8c2a52a0db840352fefcbb271b7fbd36fb60c59323cd63b9553bd771640103af5026d487f3fb6c414c
SSDEEP

768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjIm8lB4dCOBy/cMFqeoYPO+lxK:ZzFbxmLPWQMOtEvwDpj38lD/cMAT+l4

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 2 IoCs

resource	yara_rule
behavioral2/files/0x0010000000023128-13.dat	CryptoLocker_rule2
behavioral2/memory/2392-61-0x0000000002190000-0x0000000002196000-memory.dmp	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	2024-04-10_b8784728fee3f00361bde5943e7e7b9b_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 2392	408	2024-04-10_b8784728fee3f00361bde5943e7e7b9b_cryptolocker.exe	87
PID 408 wrote to memory of 2392	408	2024-04-10_b8784728fee3f00361bde5943e7e7b9b_cryptolocker.exe	87
PID 408 wrote to memory of 2392	408	2024-04-10_b8784728fee3f00361bde5943e7e7b9b_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2024-04-10_b8784728fee3f00361bde5943e7e7b9b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_b8784728fee3f00361bde5943e7e7b9b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:408
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
58KB

MD5
433a3739617e74a3421e930a8f0715fe

SHA1
7740e1fda5e4ec9986ce65ef3acbbbab2fffd83c

SHA256
832dbf8e161e74af6672833de0bd6a7ec119db66d0aa2148e05caa268150238c

SHA512
fe88456cb7cbbfffdcd52e06ab8f867d45755ffde5326f925f42dec91c7a569f01d0a1f5522f7cc85b6d3bbdd3a3674521f2062fa393e61c7235608193e152f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
1KB

MD5
bd33719b5b1ae7466145ab9c274f608c

SHA1
de5b003743c277ab7691367c1dad8d64ee503fbd

SHA256
a61513d2ccf759e5df690ff5e2e6f8ec851742e713e557fbb611555cc6f99f3a

SHA512
5745cf9beb22d56c02f584acd0600bf77d0a4b8ec6f02cd75912b37490fe322c9259b215149d865bcee0a5a0681186261e60c07371213be516b8ca0e91284a39

Download Submit
memory/408-0-0x0000000000450000-0x0000000000453000-memory.dmp

Filesize
12KB

Download
memory/408-1-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/408-2-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/408-3-0x00000000021B0000-0x00000000021B6000-memory.dmp

Filesize
24KB

Download
memory/408-17-0x0000000000450000-0x0000000000453000-memory.dmp

Filesize
12KB

Download
memory/2392-19-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/2392-25-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/2392-61-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download