Analysis

  • max time kernel
    93s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    11/06/2024, 02:30

General

  • Target

    2024-06-11_fc1b336f8ef460da34b774ab710935e1_cryptolocker.exe

  • Size

    50KB

  • MD5

    fc1b336f8ef460da34b774ab710935e1

  • SHA1

    977736ae4c23c7ad7c2f54f56e9ebd4695055cee

  • SHA256

    8688092cb3f0b430d9b8ef1c37ca4b501e8e527fbe371704f0cf8d2a0e66b31d

  • SHA512

    0d192550fc2775bc33da2b432c50b6ae645cb7097a1fc9c155c1e5a7afe87347765755e32e9a8f15501dd18f2a540403ee5241c6a71e8e91b8cb1bb660b4941e

  • SSDEEP

    768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9Rva/yYsm06Mq+:xj+VGMOtEvwDpjy+viHs7pV

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 5 IoCs
  • Detects executables built or packed with MPress PE compressor 5 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-11_fc1b336f8ef460da34b774ab710935e1_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-11_fc1b336f8ef460da34b774ab710935e1_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      PID:3548

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\misid.exe

          Filesize

          50KB

          MD5

          3058ed1418b78790d07a84e8c3b618bb

          SHA1

          cc4cbbddb463c90436b63b3444958a87d20c9cea

          SHA256

          7d65a16451af71e91725c04e13a39f54df322d62488d555fa44fc31f59a34fe6

          SHA512

          5d7776b5fddb0f0c61835c8e524602f6874353baf4c5b30366c195bd608876d3cd0d5d21ac2c6812e50ab772f8c342d1ec8fcfa155ba7bd5d360aaf3103657b4

        • C:\Users\Admin\AppData\Local\Temp\misids.exe

          Filesize

          315B

          MD5

          a34ac19f4afae63adc5d2f7bc970c07f

          SHA1

          a82190fc530c265aa40a045c21770d967f4767b8

          SHA256

          d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

          SHA512

          42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

        • memory/3424-0-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/3424-1-0x00000000020E0000-0x00000000020E6000-memory.dmp

          Filesize

          24KB

        • memory/3424-2-0x00000000020E0000-0x00000000020E6000-memory.dmp

          Filesize

          24KB

        • memory/3424-3-0x0000000002110000-0x0000000002116000-memory.dmp

          Filesize

          24KB

        • memory/3424-18-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/3548-17-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB

        • memory/3548-20-0x00000000007B0000-0x00000000007B6000-memory.dmp

          Filesize

          24KB

        • memory/3548-21-0x0000000002070000-0x0000000002076000-memory.dmp

          Filesize

          24KB

        • memory/3548-49-0x0000000000500000-0x0000000000510000-memory.dmp

          Filesize

          64KB