4ffde2f680a6e8bcb4dfad04fa62dd16716ff578f838f4b3d5be39c2f02e26e6

Analysis

max time kernel
153s
max time network
162s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 02:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-17_cf4cf7cd661e3b799ab400d6e570fde4_cryptolocker.exe
Size

83KB
MD5

cf4cf7cd661e3b799ab400d6e570fde4
SHA1

8ee1b275067ab5df47f85916d8e47905f83c6b79
SHA256

4ffde2f680a6e8bcb4dfad04fa62dd16716ff578f838f4b3d5be39c2f02e26e6
SHA512

3a3f36eb7cd2f69ea5380d1118856ea994f29f53584a46d1150d5ac4979f0e1b1b33691552a08de7559297a2f96f10a3b1a71dd9c112271881af881f68360b88
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfWafHNBJ:vCjsIOtEvwDpj5H9YvQd2B

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002351c-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000900000002351c-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1230272463-3683322193-511842230-1000\Control Panel\International\Geo\Nation	2024-04-17_cf4cf7cd661e3b799ab400d6e570fde4_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1188	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3788 wrote to memory of 1188	3788	2024-04-17_cf4cf7cd661e3b799ab400d6e570fde4_cryptolocker.exe	94
PID 3788 wrote to memory of 1188	3788	2024-04-17_cf4cf7cd661e3b799ab400d6e570fde4_cryptolocker.exe	94
PID 3788 wrote to memory of 1188	3788	2024-04-17_cf4cf7cd661e3b799ab400d6e570fde4_cryptolocker.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-04-17_cf4cf7cd661e3b799ab400d6e570fde4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-17_cf4cf7cd661e3b799ab400d6e570fde4_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3788
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
83KB

MD5
86e43fa1df8a32961b5cc0a4da86a146

SHA1
8b8b02a3799e571666e5411e839b3ddaff586bde

SHA256
b5d5c63a6f858ac12f5116a20a508683f30a3308b334c669068925766b6a96b5

SHA512
25e6be4ea28704391c9c0ff6f61f8dea375309ebbc00ea3e4856b3e3b01abe45a256ee3995b11f6a399017830954b5b06333b38a39aa70bde3b609275f2628ee

Download Submit
memory/1188-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1188-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3788-0-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3788-1-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/3788-2-0x0000000000750000-0x0000000000756000-memory.dmp

Filesize
24KB

Download