Analysis

  • max time kernel
    93s
  • max time network
    94s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14-10-2024 03:45

General

  • Target

    2024-10-14_9d2bf17840684ba9ef9ab9504712f4be_cryptolocker.exe

  • Size

    83KB

  • MD5

    9d2bf17840684ba9ef9ab9504712f4be

  • SHA1

    1687d07b67f3b8fd48976212894e30ae7d3f2553

  • SHA256

    ef6da9b319754cf3cb822e2a59b8d0cda33f124f4b6f1f8e3a3c9e70e4b53675

  • SHA512

    f87b9379219f3e84331aa6ee1879f7363769b277b4b1a431f239c031692d3c5329ed1a908e85c39baf3d444dddfdec3a95a8f453fe01d77d14b8e738e0751bb8

  • SSDEEP

    768:XS5nQJ24LR1bytOOtEvwDpjNbZ7uyA36S7MpxRXrZSUfFKazNclMjNUvva7:i5nkFGMOtEvwDpjNbwQEI8UtzNcO8vU

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-14_9d2bf17840684ba9ef9ab9504712f4be_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-14_9d2bf17840684ba9ef9ab9504712f4be_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2552
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:3848

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    84KB

    MD5

    fba3d555e0da5e4d083054bab4eb8b2c

    SHA1

    80de25c71f83950cfe805792d41da9a36ae94ade

    SHA256

    0c5d261809daca19e37f0fd944b75b1ae307d6ba6960d9ba80c860d6a957097f

    SHA512

    20e9c2ca81f2132b79d6f2ef10ccbf5b104c9a9e0dee8f50fb3cb6eb7a9562a296beec7a9527f78c144697237a3c84016c6dfdc3ff12c8838f0ccbdb05238c5d

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/2552-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/2552-1-0x0000000000520000-0x0000000000526000-memory.dmp

    Filesize

    24KB

  • memory/2552-2-0x0000000000520000-0x0000000000526000-memory.dmp

    Filesize

    24KB

  • memory/2552-3-0x0000000000540000-0x0000000000546000-memory.dmp

    Filesize

    24KB

  • memory/2552-18-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3848-21-0x0000000002070000-0x0000000002076000-memory.dmp

    Filesize

    24KB

  • memory/3848-20-0x00000000006B0000-0x00000000006B6000-memory.dmp

    Filesize

    24KB

  • memory/3848-48-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB