dcf3918388dc1f4cc83de74d946a48ce5d8230fe1b1480f053d847a573819d49

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 01:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-13_d3af97556ee5f86589c7254bf792d323_cryptolocker.exe
Size

70KB
MD5

d3af97556ee5f86589c7254bf792d323
SHA1

606b2892176013bcf4e4f572541944bd86600a42
SHA256

dcf3918388dc1f4cc83de74d946a48ce5d8230fe1b1480f053d847a573819d49
SHA512

58abfc6aa2b52547cefc5d108881c595bfb87ef788316fbf951d03ed07f5333860c012de13e62fbb6604b9f49dff70ac1885f727d80a9089e215244e9054cc8e
SSDEEP

768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUNsYD/dpu:i5nkFGMOtEvwDpjNbwQEI8UZDy

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 5 IoCs

resource	yara_rule
behavioral2/memory/5104-0-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000500000002326f-13.dat	CryptoLocker_rule2
behavioral2/memory/2372-19-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/5104-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2
behavioral2/memory/2372-28-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_rule2

Detection of Cryptolocker Samples 3 IoCs

resource	yara_rule
behavioral2/memory/2372-19-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/5104-17-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1
behavioral2/memory/2372-28-0x0000000000500000-0x000000000050F000-memory.dmp	CryptoLocker_set1

Detects executables built or packed with MPress PE compressor 5 IoCs

resource	yara_rule
behavioral2/memory/5104-0-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/files/0x000500000002326f-13.dat	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2372-19-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/5104-17-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral2/memory/2372-28-0x0000000000500000-0x000000000050F000-memory.dmp	INDICATOR_EXE_Packed_MPress

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2539840389-1261165778-1087677076-1000\Control Panel\International\Geo\Nation	2024-06-13_d3af97556ee5f86589c7254bf792d323_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2372	misid.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 2372	5104	2024-06-13_d3af97556ee5f86589c7254bf792d323_cryptolocker.exe	80
PID 5104 wrote to memory of 2372	5104	2024-06-13_d3af97556ee5f86589c7254bf792d323_cryptolocker.exe	80
PID 5104 wrote to memory of 2372	5104	2024-06-13_d3af97556ee5f86589c7254bf792d323_cryptolocker.exe	80

C:\Users\Admin\AppData\Local\Temp\2024-06-13_d3af97556ee5f86589c7254bf792d323_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-13_d3af97556ee5f86589c7254bf792d323_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Users\Admin\AppData\Local\Temp\misid.exe
  "C:\Users\Admin\AppData\Local\Temp\misid.exe"
  2⤵
  - Executes dropped EXE
  PID:2372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\misid.exe

Filesize
70KB

MD5
afba4e443df1888c2256d1c76b1a0cb3

SHA1
f7f0ef7ccd11fce76de9f9934a3857df1361de9a

SHA256
4986805b36106e0480c96375e0a5a21f40789d6962d1f8e0a44f49b82365af3e

SHA512
36f78efd72f7824f5ce94bf31322b2bf2f1dd0e51fba463928fc39785cdfb2f04bac5b24f5f65a4b0f8f72611f59d3e53c9a5fa6f20a47592181ebfc86c208d4

Download Submit
memory/2372-19-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/2372-21-0x0000000000660000-0x0000000000666000-memory.dmp

Filesize
24KB

Download
memory/2372-27-0x00000000004D0000-0x00000000004D6000-memory.dmp

Filesize
24KB

Download
memory/2372-28-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/5104-0-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download
memory/5104-1-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/5104-2-0x0000000000870000-0x0000000000876000-memory.dmp

Filesize
24KB

Download
memory/5104-9-0x00000000006A0000-0x00000000006A6000-memory.dmp

Filesize
24KB

Download
memory/5104-17-0x0000000000500000-0x000000000050F000-memory.dmp

Filesize
60KB

Download