Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20-04-2024 19:04
General
-
Target
2024-04-20_fa91e38de8c13d5a31fc05ce533fd6eb_cryptolocker.exe
-
Size
60KB
-
MD5
fa91e38de8c13d5a31fc05ce533fd6eb
-
SHA1
40b29808a88ffd223a36628d27eb0073250f2719
-
SHA256
6838fa1b49c3a991b56959caf9c7e648f3cbefdf762c336b4bcb2930e11994e6
-
SHA512
fce974715fc2ecda82279a163d17f6e8e4c6615168f4b27e78bef46de65788d7e5d612e0f2ba7a528ffac42c3a3bfa68fa16c92aeed93fba8a5e613d1ae87d0b
-
SSDEEP
768:3Uz7yVEhs9+Hs1SQtOOtEvwDpjO9+4hdCY8EQMjpi/Wpi3B3URiLqCyLuAx8XG9E:3P+HsMQMOtEvwDpjoHy7B3g9CWuAxWV
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_fa91e38de8c13d5a31fc05ce533fd6eb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_fa91e38de8c13d5a31fc05ce533fd6eb_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5f49e5b6e92d90c083e06c72fc9fd8e7d
SHA1e2f90783386bae79b6449515fcc37a3eca0ff18d
SHA2569cf165981e44cee4dff3a26558466da04e0b9c770d46e0321479544b7be239eb
SHA5128be70d5e8d0a19dd7d49d688103ccbc05cbabb3f0902ad4223a68cab2ae0d8b1dec6565065109189379cc9003cbe62ae0dac1253bc88b5aa105d352fa4535945
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB
-
Filesize
44KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
44KB