a3d63a748e16ac26aadef58a62d57cb36b523e20d69203e59fbf7490b473f065

Analysis

max time kernel
114s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-04-2024 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_d284f25310239cf266ec39476db66abe_cryptolocker.exe
Size

70KB
MD5

d284f25310239cf266ec39476db66abe
SHA1

b4c6e9eb86eaa14d8c05b0286712a707ac849e55
SHA256

a3d63a748e16ac26aadef58a62d57cb36b523e20d69203e59fbf7490b473f065
SHA512

a62f4f7c4fc21c28bffce50fac20cc454225ca30cfbde2124fbe042174db465379d75407436aa122996d3659ecc0502cb8fc5a6db2de0f91eb2b992899e01896
SSDEEP

1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs9G:C4Q2c94OtEvwDpj4H8zL

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4508-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000800000002333d-13.dat	CryptoLocker_rule2
behavioral2/memory/4508-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/1812-59-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/memory/4508-17-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/1812-59-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/4508-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/files/0x000800000002333d-13.dat	UPX
behavioral2/memory/4508-17-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/1812-59-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	2024-04-10_d284f25310239cf266ec39476db66abe_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
1812	misid.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4508-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000800000002333d-13.dat	upx
behavioral2/memory/4508-17-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/1812-59-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 1812	4508	2024-04-10_d284f25310239cf266ec39476db66abe_cryptolocker.exe	94
PID 4508 wrote to memory of 1812	4508	2024-04-10_d284f25310239cf266ec39476db66abe_cryptolocker.exe	94
PID 4508 wrote to memory of 1812	4508	2024-04-10_d284f25310239cf266ec39476db66abe_cryptolocker.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-10_d284f25310239cf266ec39476db66abe_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_d284f25310239cf266ec39476db66abe_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4848 --field-trial-handle=2260,i,9938964625802268469,1928462186077019554,262144 --variations-seed-version /prefetch:8
1⤵
PID:4440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
70KB

MD5
8b270e679b3946d52649ad475b545aff

SHA1
afec7d416202dd1dda32cc11a32cb8dedb6508aa

SHA256
277210194e16552610235e68834abbef58dfa303fa2fb102c73ee71743416de4

SHA512
6157f95a87f72bdcafe91b378104164169422d3a5033dc3a063920f085229b5e35871b55aca81df6c74cd7f757ebbea17e5482c33c0b4ef265d4bf340d28cb04

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
1KB

MD5
67655f5cf257532ff54586a491f0ccb4

SHA1
1dd28fa85707767078cd65fcb9575bd4391814ec

SHA256
eedf8072780b5003f51bca680368f9110112bdde867ee2aac2e984de9a665698

SHA512
79b32bbfb7844ba8df1681a4b76ff38550f048fcfa958e0a570f934a186d4743e049be60980de4f0b8502d078d3b30c93a5ebed83d104f0f343472c890d6c028

Download Submit
memory/1812-19-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/1812-23-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/1812-59-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4508-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4508-1-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4508-2-0x00000000004E0000-0x00000000004E6000-memory.dmp

Filesize
24KB

Download
memory/4508-3-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4508-17-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download