Analysis

  • max time kernel
    143s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/06/2024, 15:45

General

  • Target

    2024-06-12_0c434c3ae5404038ca63ba33c69acb6c_cryptolocker.exe

  • Size

    69KB

  • MD5

    0c434c3ae5404038ca63ba33c69acb6c

  • SHA1

    9a711abf8a6a3876bb22d76e125e826547bec92e

  • SHA256

    441795b1d68fe2a7ba377eabe77543f7c731d2a5eec92045ad0d476a79003e43

  • SHA512

    267c875130c48b1cc879095270570d9c20a8cd3f9f32b77305d440fbbccb01f24901559d81afc0755e0c6200f3e8ace9cdc3b1ddd827e96854efaf3eb20ed930

  • SSDEEP

    768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/dpS:i5nkFGMOtEvwDpjNbwQEI8UZDO

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 4 IoCs
  • Detection of Cryptolocker Samples 2 IoCs
  • Detects executables built or packed with MPress PE compressor 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-12_0c434c3ae5404038ca63ba33c69acb6c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-12_0c434c3ae5404038ca63ba33c69acb6c_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4292
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • Modifies system certificate store
      PID:2696
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1032 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:1028

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\misid.exe

      Filesize

      70KB

      MD5

      210fa3de9be3a61e25b1a7c7b192fde6

      SHA1

      c260cc13c278ec9acafe21d9734e78b2658d2b8c

      SHA256

      a1a3f93c53357cc9d7c1564b023aa0699fe9de9b6d3a4fd74d5852779ce23264

      SHA512

      d26b44432900249105715c03587e7f4f8c7091cf710ca02d4598a479c093d62594e7c901013ff63032c5c6a60875aa487462d6c5b10286bfe994c5c86fac87a0

    • C:\Users\Admin\AppData\Local\Temp\misids.exe

      Filesize

      315B

      MD5

      a34ac19f4afae63adc5d2f7bc970c07f

      SHA1

      a82190fc530c265aa40a045c21770d967f4767b8

      SHA256

      d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

      SHA512

      42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

    • memory/2696-18-0x00000000004D0000-0x00000000004D6000-memory.dmp

      Filesize

      24KB

    • memory/2696-19-0x00000000005E0000-0x00000000005E6000-memory.dmp

      Filesize

      24KB

    • memory/2696-49-0x0000000000500000-0x000000000050F000-memory.dmp

      Filesize

      60KB

    • memory/4292-0-0x0000000000500000-0x000000000050F000-memory.dmp

      Filesize

      60KB

    • memory/4292-1-0x0000000000600000-0x0000000000606000-memory.dmp

      Filesize

      24KB

    • memory/4292-2-0x0000000000600000-0x0000000000606000-memory.dmp

      Filesize

      24KB

    • memory/4292-3-0x0000000000620000-0x0000000000626000-memory.dmp

      Filesize

      24KB

    • memory/4292-26-0x0000000000500000-0x000000000050F000-memory.dmp

      Filesize

      60KB