Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
25-04-2024 03:29
General
-
Target
2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe
-
Size
63KB
-
MD5
178de3ca7dccb66e03e79fcd5429f55b
-
SHA1
380caf6be57e8e4413eca5e0acb92f183ecf3875
-
SHA256
dce37df831bf6b206f069f322e638cb3fff76f56619edd8862f8404850b5e0f9
-
SHA512
40dcde9c9a54caae08c9abfd71532bdf325020f30a633037a899fb08438ee2b1c186d2418be54c401a807b14fa786143aed93831b170386195e3ba407c103dae
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMTIm:TCjsIOtEvwDpj5HE/OUHnSME
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-25_178de3ca7dccb66e03e79fcd5429f55b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5f7a7afeb8fedb6ebf7b7f04821cd33ce
SHA1e4701dc8b029920a087c660ebdf7d3cc0e67749b
SHA25607fa59fd946823abfc70b8d6489ad43f57ebbb46fff041ad4611c9148e131f6d
SHA512e6711f2c3436d4201bd9d14387717ab3461302d9717ad7d72cf5efa854344e5dcad0ccf98e01a22a5809947fa6fbb49d0b422456cc804d79c83951e0bed2db58
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB