Analysis
-
max time kernel
144s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01/02/2024, 17:29
General
-
Target
2024-02-01_bb367ef2685a06ccd3f81c0676a3af34_cryptolocker.exe
-
Size
127KB
-
MD5
bb367ef2685a06ccd3f81c0676a3af34
-
SHA1
a1edc951b48093ae6a4356e6006f58ecd45e39b0
-
SHA256
413c86c03139cb330e0764a7c10433aa5d4b6f7cd9ce3e8f593c4c7eca39bf83
-
SHA512
c8dc2f7d4832983cda9cabc2c665af7045b6626e376426a507b94e7c16c2d56b4be4061bd25a4f2d89c8a312434c97bf70b5c7b1cfb2aeea7740dec452767c51
-
SSDEEP
1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//T:vCjsIOtEvwDpj5H9YvQd2Rt
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_bb367ef2685a06ccd3f81c0676a3af34_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_bb367ef2685a06ccd3f81c0676a3af34_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
127KB
MD5c2dbad2a069d3c3821b48df0be9336e1
SHA1fd44262078e4ba06d8eaba929e42d49e68730300
SHA2568bed59e49c2467c149434fe2c13f543abdbdf2a92363a51a2bf65c78d3a34730
SHA5120efc7f96c61e1e872e3b98c6276c708a453df3fb0d63a199d75d7d00af5bc0ee7608b392ef88595b455f812452a58b248d48e1928b1d440c2944d03b8a95f1fb
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB