1717886f3b47be3fff126d8ec102a713ebad440b3bde70f8e084af41f1a9a162

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-19_93709c9f30480fdc8a3ca601bfaf453b_cryptolocker.exe
Size

127KB
MD5

93709c9f30480fdc8a3ca601bfaf453b
SHA1

b7ad71110a19bec585b7666ab49cf8e400f45363
SHA256

1717886f3b47be3fff126d8ec102a713ebad440b3bde70f8e084af41f1a9a162
SHA512

fddf8ab1cc0774606d88c6f52c53faddc6c45d8a738dbfbb66d477aef40a3f41817d6faa6290e8bfb95ea7fed692e5d60a1fe15f983e27073812b1f2a0ef12ac
SSDEEP

1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//LITU:vCjsIOtEvwDpj5H9YvQd2R9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000001e97e-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x001c00000001e97e-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-259785868-298165991-4178590326-1000\Control Panel\International\Geo\Nation	2024-04-19_93709c9f30480fdc8a3ca601bfaf453b_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3380	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3380	3952	2024-04-19_93709c9f30480fdc8a3ca601bfaf453b_cryptolocker.exe	84
PID 3952 wrote to memory of 3380	3952	2024-04-19_93709c9f30480fdc8a3ca601bfaf453b_cryptolocker.exe	84
PID 3952 wrote to memory of 3380	3952	2024-04-19_93709c9f30480fdc8a3ca601bfaf453b_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-04-19_93709c9f30480fdc8a3ca601bfaf453b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-19_93709c9f30480fdc8a3ca601bfaf453b_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
127KB

MD5
d7b386131a0d30fe86028c63dbc9b00b

SHA1
181c6edb55da9dac1c01cbbaeca96c2a5156b47e

SHA256
af0fcc87978f7323251a37e070bd0934fd43eafb485f55c64a1c5689baacf845

SHA512
9291edbd293c03c41b99755700ea8ac6ee21c4ac8fa7e4d9f2139e8902ec9750c1c0b66c201c87a8e09cc2b2f25a0dc71780a4780bcd7fbf3211bf8edc602ef4

Download Submit
memory/3380-17-0x0000000002060000-0x0000000002066000-memory.dmp

Filesize
24KB

Download
memory/3380-23-0x0000000000510000-0x0000000000516000-memory.dmp

Filesize
24KB

Download
memory/3952-0-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/3952-1-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/3952-2-0x00000000021A0000-0x00000000021A6000-memory.dmp

Filesize
24KB

Download