6ea4549d379940c1acb6ae50dc71dbe5b3f4148139f2c8f72464c2dbea701c12

Analysis

max time kernel
89s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-04-2024 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-11_52bd22f60d51ea6392ce8fbcdf723298_cryptolocker.exe
Size

49KB
MD5

52bd22f60d51ea6392ce8fbcdf723298
SHA1

746a7d3ac3c1d31b4c60b2a08b883c74a5c5e140
SHA256

6ea4549d379940c1acb6ae50dc71dbe5b3f4148139f2c8f72464c2dbea701c12
SHA512

d229b87ba1bb9760864bc9133faeebf14c35e995826b6871b29f93c79435197a64bb84d4d8f572b00210cc44ffa4690fc6f4f9dc2618d575f6ad0b1e7d82f8c2
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr46xdUUuuMT8lb:vj+jsMQMOtEvwDpj5Hczer5ixuMCb

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000002311e-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000d00000002311e-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-04-11_52bd22f60d51ea6392ce8fbcdf723298_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	misid.exe

Executes dropped EXE 1 IoCs

pid	Process
4012	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 4012	1452	2024-04-11_52bd22f60d51ea6392ce8fbcdf723298_cryptolocker.exe	85
PID 1452 wrote to memory of 4012	1452	2024-04-11_52bd22f60d51ea6392ce8fbcdf723298_cryptolocker.exe	85
PID 1452 wrote to memory of 4012	1452	2024-04-11_52bd22f60d51ea6392ce8fbcdf723298_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-11_52bd22f60d51ea6392ce8fbcdf723298_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-11_52bd22f60d51ea6392ce8fbcdf723298_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
261a93d0f591ff7ca35eed2e8744ab50

SHA1
25d2a9b090f3625c409fbc23470d5e9c74d7588a

SHA256
00afcc512115d076fa65c4cd10be4515cac626928ad6af8b1289b276dfd11120

SHA512
1f74a571c8a475f26afb49d6d21d9a208b3ab095c670ff993295ff9c059f48a9f5961367876c155c448b4e4728b9a82593e7e97011f729176e3fe52f9905fa53

Download Submit
C:\Users\Admin\AppData\Local\Temp\misids.exe

Filesize
1KB

MD5
e7152324a3d9e3cb65724a5d7e5afb07

SHA1
775f49c246595cb9cac31238643d1052e054c23b

SHA256
50ba3b0466ab001e5452ba0605af67d8cad5add2d444e5138c3f562033faadfe

SHA512
5303a09c1d5816eb267e4f2c50461f3279109b744d6ac4eb62121278cbcbd120ee7d5fb6249cb8d740c38a91dee77ecd1d616c6f89b2f7e7336c24327113c241

Download Submit
memory/1452-0-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/1452-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/1452-2-0x0000000000540000-0x0000000000546000-memory.dmp

Filesize
24KB

Download
memory/4012-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/4012-20-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download