Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
22/01/2024, 15:31
General
-
Target
2024-01-22_8bfa48089b22184e025e1b73b05f7e41_cryptolocker.exe
-
Size
42KB
-
MD5
8bfa48089b22184e025e1b73b05f7e41
-
SHA1
f02f462986b8b90259f15f353cb7f1790eeae395
-
SHA256
2563ba2092b85488f86bc01fe272e73cdd4013971aa4a521f9003d127c62e08c
-
SHA512
2b9fdc05c3732f93abb2f495c81e47b32bf6b404fe9d05a2f443015ee12461de8ab7ffe351420f5e4047788d95320202e38541b4ab276b51f3cf509ee991c130
-
SSDEEP
768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4REL+cc66nkpe:vj+jsMQMOtEvwDpj5HW5Iie
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-22_8bfa48089b22184e025e1b73b05f7e41_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-22_8bfa48089b22184e025e1b73b05f7e41_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5bcf452c6dac1d46dd851da107b31b11a
SHA1930299971d343b1975f111f7c537c2406cab7d00
SHA25681dfa902e541095248032abffc2174cf82b20163ca778359e309f1927d244de9
SHA51294945d2239ba82301959503deee48b433a4413e948fc86d0544e7367280b0e4cbca66e5a5860960ee1ebe6d82ceb1f1c83adc5ce482e9fd7bf9d3e9eab94a42f
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB