Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19/04/2024, 21:29
General
-
Target
2024-04-19_6b813555ea3d1f770added3b92a00fd2_cryptolocker.exe
-
Size
83KB
-
MD5
6b813555ea3d1f770added3b92a00fd2
-
SHA1
ebd3456b8791b8042718845b5f92115b0938e10c
-
SHA256
e5bb61beb92e9f68a546ac24225bcb7a4bed34408f812c7237daa8142b98faf1
-
SHA512
c1b5c227a944629077058012463977b17fdb2e5124e5e55ff575c7d4c2d57526e6c81c10c7e6cb209358a046582ea4004b536501692a8e1f94e1854ef25d738f
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrCpc5:TCjsIOtEvwDpj5HE/OUHnSM+G
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_6b813555ea3d1f770added3b92a00fd2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_6b813555ea3d1f770added3b92a00fd2_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD54ea2f37b88ae0193484294338cdf0732
SHA120359c3d866e4bcab6305b5590d9aab6f720077d
SHA256394db02c3e1ce944197c6bf3f43bf912cd9e6a286eb72cb9ce579e3d0d75c5f7
SHA512252059fb6eb13462f0823d859d7a35ebb9e8f9952d60894fd4996519144f52901ff035a689727224d56b647142ab25b55f3a4d9cca4a6bff8c63b7475da65601
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB