Analysis
-
max time kernel
141s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24-02-2024 05:15
General
-
Target
2024-02-24_d12a8a6efd67e88a68ab1c827bc2705f_cryptolocker.exe
-
Size
62KB
-
MD5
d12a8a6efd67e88a68ab1c827bc2705f
-
SHA1
085e28c39a99201409d1acb01fe0d03036b7f8e0
-
SHA256
c0ff924d633736ced74bf1c958e109449a18eecd67f15d31aa1a3dede5f6f17a
-
SHA512
d5704d7c1321656bf7b7551f215f8b74258865aa1123063855f6c108dcedf8f213ab98211fd2f98164832f0037a22af0c8b0fdfce1ee6e225dd001937ef61788
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPvdfGR:TCjsIOtEvwDpj5HE/OUHnSMYt
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_d12a8a6efd67e88a68ab1c827bc2705f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_d12a8a6efd67e88a68ab1c827bc2705f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD59e80fedbc122f5eff91a5e945f85468c
SHA176d0c0faf12beb4207294dec65c0b0c7a932d8b1
SHA2564f24d569e64e8646d902bff66514883d08c1b89d51006972726a9d210670e50d
SHA5128c5ba1675f70500bca7548dda06e296f6fb00301fe21d85fbf9e865785caf3cf76c87672ed84df7922b244a46e3a4375714fc89a63396c0cfe8a9fc0223d9df7
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB