210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 19:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe
Size

35KB
MD5

aa9698bb26c3a1d8dbb7d3e8f198378e
SHA1

a2623463e3fe065be5408a2bc41adba4a1116dfc
SHA256

210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc
SHA512

fc3f5ca46f71e7681ff22d513a947a191031223ea02a69145e2bbdc75917bbe4b476980e01b2c954b1c9603c5c6da206f3df20c51c2ab9168475863a45d756a9
SSDEEP

768:fTz7y3lhsT+hs1SQtOOtEvwDpjfAu9+4o:fT+hsMQMOtEvwDpjoIHo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e9b1-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e9b1-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4084619521-2220719027-1909462854-1000\Control Panel\International\Geo\Nation	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe

Executes dropped EXE 1 IoCs

pid	Process
2080	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 2080	976	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe	84
PID 976 wrote to memory of 2080	976	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe	84
PID 976 wrote to memory of 2080	976	210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe	84

C:\Users\Admin\AppData\Local\Temp\210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe
"C:\Users\Admin\AppData\Local\Temp\210cdc0528e02dfbf4d3297c816781f3992a66efa6744e679e1819b1081cc6bc.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
36KB

MD5
67b71464b1b7da866fe1072bd8ec33d3

SHA1
8f04e25d90d418b82e9579154786de24b589a9e9

SHA256
62403af3c2210cc2cdc6be2359fcdb2c5dd95fe138dbeaca2a34c895e7516805

SHA512
0aff044a5b57e674935d9cf458f796ef51cafdaaecb4a55316f73ede162e3e805be670ef7023ddef079b000e8033c6e1c3da73153af6afd3e48d528c09cf78b3

Download Submit
memory/976-0-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/976-1-0x00000000005B0000-0x00000000005B6000-memory.dmp

Filesize
24KB

Download
memory/976-2-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/2080-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/2080-21-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download