Analysis

  • max time kernel
    95s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 03:54

General

  • Target

    2024-11-21_89a87e83ba1c05336d4e4c1a3c029343_cryptolocker.exe

  • Size

    70KB

  • MD5

    89a87e83ba1c05336d4e4c1a3c029343

  • SHA1

    62e208b8ba7ec2dfbff1f8a574027a28f6d04572

  • SHA256

    acc816b2bc413a866d8ec912a4a939dd157f65d9f0388e404fdfa6b11c3237f4

  • SHA512

    322304e3986d4c09d82bb489d6f50d5b15c8dacef77a20195738fbc86d86a528f1d908f71a3e2410a43ce0e93d909474828a777c96610b7faf646a650a611177

  • SSDEEP

    768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEpE0P/xFI0tSbQ:6j+1NMOtEvwDpjr8ox8UDEpN/jhOQ

Score
7/10

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-11-21_89a87e83ba1c05336d4e4c1a3c029343_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-11-21_89a87e83ba1c05336d4e4c1a3c029343_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:536
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      PID:4344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    70KB

    MD5

    43d1372cabc8fe667a7498feccd3398e

    SHA1

    2f508a7f73aa339646a6bcf3bc2e52f52d9e8335

    SHA256

    237a7addde467b315285387b8b3d08226d62e56f402853a732b935e3d254f139

    SHA512

    64ad2ec37b49259c39aefd5d4a6ab0bc03c8c6b4baeb51059ee2664a1d6fac5d0665630abe92afe1d47fd6f278cbad0888aedb9f6618a3662f6402a995b3592c

  • C:\Users\Admin\AppData\Local\Temp\misids.exe

    Filesize

    315B

    MD5

    a34ac19f4afae63adc5d2f7bc970c07f

    SHA1

    a82190fc530c265aa40a045c21770d967f4767b8

    SHA256

    d5a89e26beae0bc03ad18a0b0d1d3d75f87c32047879d25da11970cb5c4662a3

    SHA512

    42e53d96e5961e95b7a984d9c9778a1d3bd8ee0c87b8b3b515fa31f67c2d073c8565afc2f4b962c43668c4efa1e478da9bb0ecffa79479c7e880731bc4c55765

  • memory/536-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/536-2-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/536-1-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/536-3-0x0000000002230000-0x0000000002236000-memory.dmp

    Filesize

    24KB

  • memory/536-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/4344-19-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/4344-20-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/4344-48-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB