e6f2ff6e896cd6e0a09df3c01db810f1cfb139cc4d9e87b303b7761017e50b89

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 10:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe
Size

61KB
MD5

0e37139c18ce6fc2cb88aec20a340be9
SHA1

71c64949bd04f74438125812b6028ca0e6e6894f
SHA256

e6f2ff6e896cd6e0a09df3c01db810f1cfb139cc4d9e87b303b7761017e50b89
SHA512

db45e65cd187194fae0c65041422a9c23ca4a70ebb60e721d5cbe0bbf9335365d4737ee25e4ee13b5041da4ce6d3a7ddbd7678dcaaa39955e357539507410fbf
SSDEEP

1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMNuSP:TCjsIOtEvwDpj5HE/OUHnSMZw

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/2520-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000900000001e6f5-13.dat	CryptoLocker_rule2
behavioral2/memory/648-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2520-18-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/648-27-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 5 IoCs

resource	yara_rule
behavioral2/memory/2520-0-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/files/0x000900000001e6f5-13.dat	CryptoLocker_set1
behavioral2/memory/648-17-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2520-18-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1
behavioral2/memory/648-27-0x0000000000500000-0x000000000050E000-memory.dmp	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4092317236-2027488869-1227795436-1000\Control Panel\International\Geo\Nation	2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
648	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2520 wrote to memory of 648	2520	2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe	86
PID 2520 wrote to memory of 648	2520	2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe	86
PID 2520 wrote to memory of 648	2520	2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-18_0e37139c18ce6fc2cb88aec20a340be9_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2520
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
61KB

MD5
f89f0e72a76e165adaa3730103d61297

SHA1
e19300a022b2b88ad145e74d7617d4ab1635738c

SHA256
f5fe19aad48d0feb88cc6c81a38df610d48cd93eac5f89bbdbe2599aadc3928c

SHA512
a6749dd85fc3c1a7b464c2e9ceb263013cfee72916924e7863dc2460a4397e049360fec18d66f6d651834efd500b2c78438fcf7ea5a9907e955a8fd3c6729547

Download Submit
memory/648-17-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/648-20-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/648-21-0x0000000001FF0000-0x0000000001FF6000-memory.dmp

Filesize
24KB

Download
memory/648-27-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2520-0-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download
memory/2520-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/2520-2-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/2520-3-0x0000000002050000-0x0000000002056000-memory.dmp

Filesize
24KB

Download
memory/2520-18-0x0000000000500000-0x000000000050E000-memory.dmp

Filesize
56KB

Download