Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19-02-2024 22:47
General
-
Target
2024-02-19_a1465aaec92738f4c35a4ab4ee28fe6f_cryptolocker.exe
-
Size
62KB
-
MD5
a1465aaec92738f4c35a4ab4ee28fe6f
-
SHA1
9a1c6f238b6f82d73ed92cc1b11ebfb743000599
-
SHA256
9bce5390c783e44d9f03887f1e7ee2884fdbe8fa0dc5a6b85c5183c5f2db5556
-
SHA512
62d8c94d7f1768c00583d68c22615167302e679c2ea5518c2b98004ca69b7c95a1ee156297c79bea21121b9754b9cab8fc050ff1774c4bb5dcd63302cb8ec85d
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPvdB:TCjsIOtEvwDpj5HE/OUHnSMYg
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_a1465aaec92738f4c35a4ab4ee28fe6f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_a1465aaec92738f4c35a4ab4ee28fe6f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5b4404569417100ab20a3a659eb67a377
SHA101a337f3e05c05cc77854f4aa9374d4721d26db7
SHA2565ade418471dcf3b8508d1719daf239c2ff1c97e5fbffa3550bd1a745bbd62489
SHA5127d77aaa9cdaf3d977fd1c1f83e3cce934e9c5d066963a5fb37ba120d70461e3674a0893bb608438af56440105bb8ad3eb513710a52b068d2b481d5da1d66ec33
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB