3bf07336833473c0eadd63c40e2f332224b75dc200b4a5b691ff2e1b83f98fab

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15/04/2024, 23:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-15_d0893c064d802fa755ee0ddc4fe66af5_cryptolocker.exe
Size

82KB
MD5

d0893c064d802fa755ee0ddc4fe66af5
SHA1

19e36658be993a9253ee1cb889fbf8cfa8795492
SHA256

3bf07336833473c0eadd63c40e2f332224b75dc200b4a5b691ff2e1b83f98fab
SHA512

6493a29ca58710f6ac6f30f4e5b5d6625e9ea0faf940d3237490a6e2ccbcfa6d6d67ba4997a22bae8fcb104c2c594f6edc0fef49ed42e932e3df46de4280341e
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrhj:TCjsIOtEvwDpj5HE/OUHnSMv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/4372-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0008000000023411-13.dat	CryptoLocker_rule2
behavioral2/memory/4372-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/5040-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/4372-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x0008000000023411-13.dat	CryptoLocker_set1
behavioral2/memory/4372-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/5040-26-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-776854024-226333264-2052258302-1000\Control Panel\International\Geo\Nation	2024-04-15_d0893c064d802fa755ee0ddc4fe66af5_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
5040	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 5040	4372	2024-04-15_d0893c064d802fa755ee0ddc4fe66af5_cryptolocker.exe	89
PID 4372 wrote to memory of 5040	4372	2024-04-15_d0893c064d802fa755ee0ddc4fe66af5_cryptolocker.exe	89
PID 4372 wrote to memory of 5040	4372	2024-04-15_d0893c064d802fa755ee0ddc4fe66af5_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-04-15_d0893c064d802fa755ee0ddc4fe66af5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-15_d0893c064d802fa755ee0ddc4fe66af5_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:5040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
82KB

MD5
ff05132360abfc1b4c30e8489f388048

SHA1
0ebdd3262ea370bf4c54cc59685229100e447044

SHA256
6698dcd2699af9ab6449e405f97b2bc17d1935694b4da50aafe369eaf7cc5bbc

SHA512
13ba4bd73df4069820d61077205f7fb1dd37ccbc1dac8a709fc66c069df739ad25746ab5fd6dc33d983f04db23123d7640fdf98a66b73add142369e201f72f38

Download Submit
memory/4372-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/4372-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4372-2-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4372-3-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/4372-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/5040-21-0x0000000000570000-0x0000000000576000-memory.dmp

Filesize
24KB

Download
memory/5040-19-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

Filesize
24KB

Download
memory/5040-26-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download