497fc189b0cd09a92351998a4fc8c48fc57f25e04eb222e737ec709a77b2852b

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 04:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_fcbf3bf3b65451142e630ad64e440ff0_cryptolocker.exe
Size

51KB
MD5

fcbf3bf3b65451142e630ad64e440ff0
SHA1

8e750c2eeee0c6aede38692b21ee42c6a85153c0
SHA256

497fc189b0cd09a92351998a4fc8c48fc57f25e04eb222e737ec709a77b2852b
SHA512

8a477e5d4252570abce2e5d8f662b0d35ca5bbc601e2262eb5ad23d4461034a0b003e862c9e42e893d8f80a538c935773533c423d55f70e5492977a6a053e0af
SSDEEP

1536:nP+4zs2cPszL3MOtEvwDpj4Hy7B3g9CWuAxWLQHz:m4Q2ckzIOtEvwDpj4HYs

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/3960-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000800000002323c-13.dat	CryptoLocker_rule2
behavioral2/memory/3960-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2444-59-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 2 IoCs

resource	yara_rule
behavioral2/memory/3960-25-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2444-59-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral2/memory/3960-0-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/files/0x000800000002323c-13.dat	UPX
behavioral2/memory/3960-25-0x0000000000500000-0x0000000000510000-memory.dmp	UPX
behavioral2/memory/2444-59-0x0000000000500000-0x0000000000510000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-04-10_fcbf3bf3b65451142e630ad64e440ff0_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
2444	misid.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3960-0-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/files/0x000800000002323c-13.dat	upx
behavioral2/memory/3960-25-0x0000000000500000-0x0000000000510000-memory.dmp	upx
behavioral2/memory/2444-59-0x0000000000500000-0x0000000000510000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 2444	3960	2024-04-10_fcbf3bf3b65451142e630ad64e440ff0_cryptolocker.exe	93
PID 3960 wrote to memory of 2444	3960	2024-04-10_fcbf3bf3b65451142e630ad64e440ff0_cryptolocker.exe	93
PID 3960 wrote to memory of 2444	3960	2024-04-10_fcbf3bf3b65451142e630ad64e440ff0_cryptolocker.exe	93

C:\Users\Admin\AppData\Local\Temp\2024-04-10_fcbf3bf3b65451142e630ad64e440ff0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_fcbf3bf3b65451142e630ad64e440ff0_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=940 --field-trial-handle=2252,i,16504368816373493055,9578615028378602855,262144 --variations-seed-version /prefetch:8
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
51KB

MD5
2c761dc80d65cf06d45c7390a9bb27a6

SHA1
6ed4099380399dc66bb796625f3f0c7334020aed

SHA256
43d3170022bdc41a2757dc4fe103cb7e5222f421ffb742b9542a2f985e04f8ce

SHA512
1420390119997a0b4bc54bf428e27bf1c25d5c10602adb8150862b35b7ec60a241221ebac4f1580caddacb4b0291717714d6fd428d5f209803b168a5b12f44be

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
1KB

MD5
2426341b6e59fc67b45cf3cb48d2e6df

SHA1
7f79abc3eb351bcb4a7dcf8a8a13fc39eea209ad

SHA256
049334d24a33eb3b27d29699effe8e8d31328d662d720efee5172a2e6f08d6d1

SHA512
5c2e4c72b4fc6b1765cfbc0d5fee4652a06e6f22b134563e0dbf8cf7f9d4d3d29b5132e764e3d22cb9edf7d259d514eaaf2e86954783043a20b8bf1837b6a1c9

Download Submit
memory/2444-18-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/2444-19-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/2444-59-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3960-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/3960-1-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/3960-2-0x0000000000620000-0x0000000000626000-memory.dmp

Filesize
24KB

Download
memory/3960-3-0x0000000000650000-0x0000000000656000-memory.dmp

Filesize
24KB

Download
memory/3960-25-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download