Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-03-2024 21:35
General
-
Target
2024-03-11_b7b8da06c145737a3ba81d9eb6ed12ac_cryptolocker.exe
-
Size
81KB
-
MD5
b7b8da06c145737a3ba81d9eb6ed12ac
-
SHA1
5f6dfdeb7755e17fc9f65230d708748be47a9fd7
-
SHA256
666bf533296a8c762e0b57cc7dee678170b0d6b23a3445c2f375d1615a8f92cf
-
SHA512
95d5f0d6252aeef7fbb3266d9b7470083001cb208ca8a29949955c47fc95d9f2cf3096c98174f65a6b27f8378bd20270857be3433bd2f9611bfdfe56ec29e9b1
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMAe1:TCjsIOtEvwDpj5HE/OUHnSMz
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_b7b8da06c145737a3ba81d9eb6ed12ac_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_b7b8da06c145737a3ba81d9eb6ed12ac_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD56df58d97a788cefbef9ec21ecd4f3b26
SHA1e1f3408ce17bcd195d151e273ed0dab604a8bc5d
SHA256c12464db0d0d66a76f7d529b6095c738817f1a68523165d1b5cd4434e3804d9e
SHA512c559cca297ddced0921495ec3ec0827a1a8079b1c2eef14ebb73ded42c29443fddaaba3776c940ee92d56ad24f0fefc04d36900f9fff5ee5810bb36c706718dd
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB