49fcfa897454898a1299c085a3b36e1398f4cadfbe52322db4e203a4041d29c5

Analysis

max time kernel
143s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
16/04/2024, 04:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-16_3c3136149667fde60ed0c51da91b12de_cryptolocker.exe
Size

48KB
MD5

3c3136149667fde60ed0c51da91b12de
SHA1

ee99b6c8bc1722f10f893f23e90620a297c5e903
SHA256

49fcfa897454898a1299c085a3b36e1398f4cadfbe52322db4e203a4041d29c5
SHA512

b8dadd66f8ead1cf74aa14fe2a1792c04b55f2cf3aa52dee4ddb921dd427a6fe89ed2e1de307a378c61775790a8851988da608f2082d3402218b5d3885c42d9a
SSDEEP

768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaN4NOn:xj+VGMOtEvwDpjy+TN4g

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral2/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000800000002325a-13.dat	CryptoLocker_rule2
behavioral2/memory/1640-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/4616-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 4 IoCs

resource	yara_rule
behavioral2/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000800000002325a-13.dat	CryptoLocker_set1
behavioral2/memory/1640-18-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1
behavioral2/memory/4616-26-0x0000000000500000-0x0000000000510000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 4 IoCs

resource	yara_rule
behavioral2/memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000800000002325a-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/1640-18-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/4616-26-0x0000000000500000-0x0000000000510000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-04-16_3c3136149667fde60ed0c51da91b12de_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4616	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 4616	1640	2024-04-16_3c3136149667fde60ed0c51da91b12de_cryptolocker.exe	92
PID 1640 wrote to memory of 4616	1640	2024-04-16_3c3136149667fde60ed0c51da91b12de_cryptolocker.exe	92
PID 1640 wrote to memory of 4616	1640	2024-04-16_3c3136149667fde60ed0c51da91b12de_cryptolocker.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-04-16_3c3136149667fde60ed0c51da91b12de_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-16_3c3136149667fde60ed0c51da91b12de_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3744 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
1⤵
PID:3052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
48KB

MD5
95f2c0040259b19f34026d166e4c491f

SHA1
662deef4860baa8fae7317c42901f18109ad9be6

SHA256
4ee50839246ea66663a1fe1d001215331049ba9e6264cb25fb2484b1f0051d74

SHA512
7f4f9851a94c8d67bb38a35823d9bbaf5e0d9d74b8443410c559ed0094140c1ab5c86a4d030848662830e8d4a6d22792743311cb5f2aad520ccc41604bf39acb

Download Submit
memory/1640-0-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/1640-1-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1640-2-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1640-3-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1640-18-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download
memory/4616-19-0x00000000007D0000-0x00000000007D6000-memory.dmp

Filesize
24KB

Download
memory/4616-20-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/4616-26-0x0000000000500000-0x0000000000510000-memory.dmp

Filesize
64KB

Download