Analysis
-
max time kernel
137s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
29/01/2024, 09:36
General
-
Target
2024-01-29_650d9ac9932d1e85f7fc3e43b7bb17c9_cryptolocker.exe
-
Size
88KB
-
MD5
650d9ac9932d1e85f7fc3e43b7bb17c9
-
SHA1
879d8126ef9ff0edc8d79458c391bde7905cc754
-
SHA256
ad35f702184d9195cae07f8ebab4a762335fc64bb3e6b6a2e700fc146a5241f9
-
SHA512
8ea78b542d03cf3aa4ce9923654c3fc305e9076c0e64f21343aad232dc18c48d7f3d5eefc2b85a1c81cfd361b64875c04d543fbe4b04a3253731ae7e51dd5ee5
-
SSDEEP
1536:vj+jsMQMOtEvwDpj5H8u8rBN6nqEZNi1OkQNp/:vCjsIOtEvwDpj5H8zPsF
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_650d9ac9932d1e85f7fc3e43b7bb17c9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_650d9ac9932d1e85f7fc3e43b7bb17c9_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
89KB
MD5f5b4c5e2e3ae3fa7578034a1e42bbdf7
SHA12186b5013cc5b88c28e57206812f75b38d6fe1f3
SHA256679223c760c9e75ce27fcc567d41fc55abce4ec9ee775a63bb0a0ad1b78432ca
SHA512c77a71fad1015ce4d4bcc4b38daae8dd69a105117a07bfe21a4502a9b9cabf879b5c0a86c290682a5ff8d236af59193165b70298eedd13a960cf969fe282de1a
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB