Analysis
-
max time kernel
142s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/02/2024, 21:22
General
-
Target
2024-02-19_03a918db30abbc4b755c5c46efc5fae9_cryptolocker.exe
-
Size
62KB
-
MD5
03a918db30abbc4b755c5c46efc5fae9
-
SHA1
5a2b32ce05688145457ff3fdb9ca56d5f11ac8e5
-
SHA256
3c9f4f9cf2e976a43362ff69b49efd91612029371dbb87d3d266081da9bc9de9
-
SHA512
6f423fdda2b3f0863ccdc4d51725e9e488789cf2c8629bfa2cfce3d9468a8528781be0d55971964a3a586ddfda3f32edf9b8415160af6e1cc235df1f94eec5d6
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPvdc:TCjsIOtEvwDpj5HE/OUHnSMY9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_03a918db30abbc4b755c5c46efc5fae9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_03a918db30abbc4b755c5c46efc5fae9_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5d5579e82c2bca2d1f38da9d37fb5e42a
SHA10a21825654a7983b10dc93a9b9fa2b91100d474e
SHA256b71ba725bee90fb63a2709206be1beecbb1f32568f5a8fb3e5fbc6f8a87aa961
SHA512c6b75a4c2536cfcf246d7c8f694ca700ae460d66d74b400e5faa065e63de62ca406258aa6da580c199d12b0172e8c8994f897620e6e836745328853dda41ad20
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB