Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22/02/2024, 09:29
General
-
Target
2024-02-22_0fcd53109c82707a87bb035727ad9106_cryptolocker.exe
-
Size
89KB
-
MD5
0fcd53109c82707a87bb035727ad9106
-
SHA1
d3b49917676b60443ebac592a6849786e015b57b
-
SHA256
8e1acb9430f4964f516d93bf5b214d6731fb789ccbf89238d94515bcab2739c6
-
SHA512
14f6ec5bee50ff72889d49793e58af00c9b390c8e777493fcbd1e172cc981daedb9f7b46134f8bf75fe2b156b6914bd805c367678c37d59c4da34b0fed8be4fd
-
SSDEEP
1536:vj+jsMQMOtEvwDpj5H8u8rBN6nqEZNi1OkQNpAZ3:vCjsIOtEvwDpj5H8zPsM
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_0fcd53109c82707a87bb035727ad9106_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_0fcd53109c82707a87bb035727ad9106_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
90KB
MD5b2c6aa2ee0ed18cf6e797135efb1d89b
SHA131b7fa0f90987d8a2fe712fa2ee9f9a2ed1ac82f
SHA256516895e177b9f40f659e3c4d29af5a601b1b6218bc37c49e7e5986bf5a3540b2
SHA51218dbf111b6d549aac49843b91137d7447a9edc4bee4a09106b061981e5aa0af466bdb691199eeab80a51f05c0c34b8c0457248d65b87f0848f3bed6028de29ae
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB