Analysis
-
max time kernel
142s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/02/2024, 05:35
General
-
Target
2024-02-04_5cb0df9f6bdc8b3e1de29587c66e94fb_cryptolocker.exe
-
Size
126KB
-
MD5
5cb0df9f6bdc8b3e1de29587c66e94fb
-
SHA1
7ba0192a41f88e6c67d7e728729f91c3d02c891f
-
SHA256
059752d751b712db8673676c6ac30e720dc81254a76cc7ad875b3f00f5328b6e
-
SHA512
f99f9e3dcc205daa36685f1c4d6d4c1eed88df5345baff5ff48e6962c9af654fe7c82084f39070b8a4b9770f6106ea8ed882ba27c854657c8af75314d9ae7205
-
SSDEEP
1536:vj+jsMQMOtEvwDpj5HwYYTjipvF2hBfIuBKLUYOVbvh//i7:vCjsIOtEvwDpj5H9YvQd2RW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_5cb0df9f6bdc8b3e1de29587c66e94fb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_5cb0df9f6bdc8b3e1de29587c66e94fb_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
126KB
MD50eef37347b76c3647633c9a40277b4cc
SHA153fd226ae5d7dd68772460bd8dafb921f2f61206
SHA25630dd24fe0717042bae6e2fcf2a02e908a0634dfcae14e4a1e05ed66ff5f95e0f
SHA512a51a4977e36842c1defc5dc54faab1f0ccc2d34e2ea1c6ce6c92cbb5df81388d7d0b6a7bcc8c85a49735e7296fef06e3e681dbc0d7599b93c99c6313b8ea5d3f
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB