Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/02/2024, 08:52
General
-
Target
2024-02-19_c24569c5b79d94d61cc88f0bb964b999_cryptolocker.exe
-
Size
35KB
-
MD5
c24569c5b79d94d61cc88f0bb964b999
-
SHA1
0e578ec816f644601572da4b4984051a5ae94b4c
-
SHA256
b90a8975f17badaaeb37484963fe7e04e76238ec628fe4f941d43579d99d2fbc
-
SHA512
d499c4c274c01bdda4de5db20b72153cf08e8675bb4ef699faf718068c0d5f48dc37a5592feb1e9113bc66eea69d4d8fdfe9f5221065951c63ba024dd631a802
-
SSDEEP
768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4/UkRYN:vj+jsMQMOtEvwDpj5HcSYN
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_c24569c5b79d94d61cc88f0bb964b999_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_c24569c5b79d94d61cc88f0bb964b999_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5784c991155445f54c79f7c73fd7511c5
SHA157d517426012254a9d320019266a74a89df33766
SHA256be6819364cd8ec938a7a0a822728e831ce2977b9b108053ebfc45d7b64034192
SHA51234c441ee5637bc38f3e8ef5601d53062711506a78597680fa7304d6bd60f0bd7fbfac7a4da9d746c623cc99cfca1aecb6afef5fe0811a79c042b5eb90abbea55
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB