Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
12/06/2024, 18:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe
-
Size
43KB
-
MD5
64fe9fad41d1ad9155251aa498ed7083
-
SHA1
71dd4c26dc514e97f8c95d86ad4f87c31ea4b835
-
SHA256
011e185ccbc67d85bef765555f0ab87755f53adceafda7650998d4a1a4044974
-
SHA512
f3c5a889359657d86f8506181305c83a8ddf4794b19471f813ea6de95c57616ee4f66019d42a3eb61e43c8e3a616c2dd57a5f66e2fc859deff269105d5e88d5b
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnY1n9V:m5nkFNMOtEvwDpjG8hgpY19V
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
resource yara_rule behavioral2/memory/4296-0-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral2/files/0x0005000000023276-13.dat CryptoLocker_rule2 behavioral2/memory/4296-18-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 behavioral2/memory/3132-27-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_rule2 -
Detection of Cryptolocker Samples 2 IoCs
resource yara_rule behavioral2/memory/4296-18-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 behavioral2/memory/3132-27-0x0000000000500000-0x000000000050E000-memory.dmp CryptoLocker_set1 -
Detects executables built or packed with MPress PE compressor 4 IoCs
resource yara_rule behavioral2/memory/4296-0-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/files/0x0005000000023276-13.dat INDICATOR_EXE_Packed_MPress behavioral2/memory/4296-18-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress behavioral2/memory/3132-27-0x0000000000500000-0x000000000050E000-memory.dmp INDICATOR_EXE_Packed_MPress -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 3132 misid.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4296 wrote to memory of 3132 4296 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe 86 PID 4296 wrote to memory of 3132 4296 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe 86 PID 4296 wrote to memory of 3132 4296 2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_64fe9fad41d1ad9155251aa498ed7083_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
PID:3132
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD518db5ba22fe538129b87b48f23cd90c8
SHA132bb6fc10ef0d2c18a8c04c7ece576f76b89d4df
SHA25601485005ff54b281ea74ef3c76060a7e6bd00552bfced1c23e69ce14b3cc01a1
SHA5123eb7a22ee50415c7faf67ce019f05d751cd5714eadbd1f562a0fc827df03d0abc693950981580221226a8a8eb51a5a61190779ba359a2e2f96ca83bc09a56de9