73625e03d69fb88449cafb6cb58cf1d5d5e71fd2829001723c3cb3d050f8c614

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-10_d0fc525552ac9c54657e4b0dd0e64ed1_cryptolocker.exe
Size

49KB
MD5

d0fc525552ac9c54657e4b0dd0e64ed1
SHA1

95cd793f18cd5260ec0cbb5bc4d6ff8abb3d7449
SHA256

73625e03d69fb88449cafb6cb58cf1d5d5e71fd2829001723c3cb3d050f8c614
SHA512

d7c030caca64241343f2e5b8637362a90e27c8722c3a38175b21a6764f2839a6d971397c5becf1961f91d77dbe56fae8cc6c6387cf2e77cf2a3a118deccddc9c
SSDEEP

768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/Uth8igNrr42A7n0FmB0n+s:vj+jsMQMOtEvwDpj5HczerLO04B/s

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022f51-12.dat	CryptoLocker_rule2

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000022f51-12.dat	CryptoLocker_set1

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-06-10_d0fc525552ac9c54657e4b0dd0e64ed1_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3176	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 3176	1848	2024-06-10_d0fc525552ac9c54657e4b0dd0e64ed1_cryptolocker.exe	82
PID 1848 wrote to memory of 3176	1848	2024-06-10_d0fc525552ac9c54657e4b0dd0e64ed1_cryptolocker.exe	82
PID 1848 wrote to memory of 3176	1848	2024-06-10_d0fc525552ac9c54657e4b0dd0e64ed1_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-10_d0fc525552ac9c54657e4b0dd0e64ed1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-10_d0fc525552ac9c54657e4b0dd0e64ed1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:3176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
50KB

MD5
8e8c8718a6ef1e5af982220f41bfad2d

SHA1
4698551027d2897645d3781ad472730aa2848614

SHA256
eb33fe6e820b1eedfc1739ce202de48a67f22a4c8d54b1f334fb1c53f2df717b

SHA512
969af109f0712ae3f640790f6f6a8ed96792ed1c651669114a927e47d5734abc70e210f5596a70e3a3e736472df6b17b994a3b121e1cb11778528ef3040e4f7c

Download Submit
memory/1848-1-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1848-0-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/1848-8-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/3176-17-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3176-23-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download