Analysis

  • max time kernel
    147s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-02-2024 18:44

General

  • Target

    2024-02-21_26afe21ab5ffa2a1d0d44967bdf7a445_cryptolocker.exe

  • Size

    126KB

  • MD5

    26afe21ab5ffa2a1d0d44967bdf7a445

  • SHA1

    e91d04f0db0af1dbdc03beb62c4b805a4bb6ca4c

  • SHA256

    924e65377b7b65ae4e0e3a838e935973591671c13d8c74204ff0ec7b846c2fa6

  • SHA512

    e00f9690ec941b04bb459fad62d2395ea499ee48401a97a57de350742ed06f458f6a8e6ee5ebb2ddacb35b7ff63f78475d07ed481b0d7c89bb517a71885c066f

  • SSDEEP

    1536:gUj+AIMOtEvwDpjNbwQEIPlemUhYwkkxGBpR/zV:vCA9OtEvwDpjT

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Detection of Cryptolocker Samples 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-21_26afe21ab5ffa2a1d0d44967bdf7a445_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-21_26afe21ab5ffa2a1d0d44967bdf7a445_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4516
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:4412

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    126KB

    MD5

    f4431ba59a076abb00d43c6002811300

    SHA1

    3b951bd28c4a0613d3823007fd576453d1bdf456

    SHA256

    c8c2506a84093ab5ac0d53843c1acaf0a6ece1ea8bb621d15434ac8afa24c9ab

    SHA512

    a307108ea31d60bed013f339b5108559f2126171de843462dd3fcf5e04dbdcb199305f56da68826ce0c481fe2f10b00c0fe8deadd6ab55b5509f0a173083e1ca

  • memory/4412-17-0x00000000004F0000-0x00000000004F6000-memory.dmp

    Filesize

    24KB

  • memory/4412-21-0x00000000004D0000-0x00000000004D6000-memory.dmp

    Filesize

    24KB

  • memory/4516-0-0x0000000002300000-0x0000000002306000-memory.dmp

    Filesize

    24KB

  • memory/4516-1-0x0000000002300000-0x0000000002306000-memory.dmp

    Filesize

    24KB

  • memory/4516-2-0x00000000005F0000-0x00000000005F6000-memory.dmp

    Filesize

    24KB