Analysis

  • max time kernel
    130s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 10:42

General

  • Target

    2024-05-26_95b6e7c88ac17a92a43a02732c3c639d_cryptolocker.exe

  • Size

    71KB

  • MD5

    95b6e7c88ac17a92a43a02732c3c639d

  • SHA1

    30246a7677305c04fffb04b8d773e6a030b49c58

  • SHA256

    5dce237ad2d285c8b26e797b4170adb33f34aa98ecbedae4436b56b2847da905

  • SHA512

    2352ae13d52d7cf2d7901ca3edca139f985984d94409e4c311957613f5c5a68d97d39a4fc46e62caaf0a63b6a44749eb053913d45e845bb4b8e508d913f0ffde

  • SSDEEP

    1536:nj+4zs2cPVhlMOtEvwDpj4H8u8rZVTs95h:C4Q2c94OtEvwDpj4H8zi

Score
9/10
upx

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 3 IoCs
  • UPX dump on OEP (original entry point) 5 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-26_95b6e7c88ac17a92a43a02732c3c639d_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-26_95b6e7c88ac17a92a43a02732c3c639d_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      PID:4392

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\misid.exe

          Filesize

          71KB

          MD5

          489edcef5d30325d312d1e78ab28fba4

          SHA1

          6d77f5f7dfaaf7c8a8c5d8992a8967c1a5bf4d5d

          SHA256

          bb178fbf9462525418eef36f8a6bb07726163b693f31cf5ab389d57b988828a1

          SHA512

          9dd3709d95ed634f7f257b23d62ed37516d2c5f43986074ecebac1cab752dd447d163245087241473842bc0a99e0e383f005a04f8b0894b85c29d253af14fd69

        • C:\Users\Admin\AppData\Local\Temp\misids.exe

          Filesize

          315B

          MD5

          a34ac19f4afae63adc5d2f7bc970c07f

          SHA1

          a82190fc530c265aa40a045c21770d967f4767b8

          SHA256

          d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

          SHA512

          42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

        • memory/4392-19-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/4392-21-0x0000000000510000-0x0000000000516000-memory.dmp

          Filesize

          24KB

        • memory/4392-27-0x00000000004E0000-0x00000000004E6000-memory.dmp

          Filesize

          24KB

        • memory/4392-50-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/4736-0-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/4736-1-0x00000000007C0000-0x00000000007C6000-memory.dmp

          Filesize

          24KB

        • memory/4736-2-0x00000000007E0000-0x00000000007E6000-memory.dmp

          Filesize

          24KB

        • memory/4736-9-0x00000000007C0000-0x00000000007C6000-memory.dmp

          Filesize

          24KB

        • memory/4736-18-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB