Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27/04/2024, 17:07
General
-
Target
2024-04-27_125be19c8845a094eafc721397998c89_cryptolocker.exe
-
Size
84KB
-
MD5
125be19c8845a094eafc721397998c89
-
SHA1
429b24ed91efa0a161ee243e7dae98dcbbd89b8c
-
SHA256
02faeb0c38b972862247c3b2a04b2e707577a2825977179af390bdc0c0f1b911
-
SHA512
3a0c64d90dfbeac8b2e8a26ff6703354758d4ebeaf3bd80077db809213049efe351b3c8901d2ffad95a6d08f1a50f2682504311ec7ae2b68026052789f3d7455
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrCL:TCjsIOtEvwDpj5HE/OUHnSMy
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_125be19c8845a094eafc721397998c89_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_125be19c8845a094eafc721397998c89_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
84KB
MD56830ce8351667ec75813a2d894414b3c
SHA148a0b507d07c99bab6ed11d319c1fef954bbcd12
SHA256166aef8ac080ba88248b7711978791a840be3ce4bb5fa268a239b5514cd6d81b
SHA51260ca7cbf425c8823e8e5b127daa84fdeeb0335c55e1857c5a43249c689d356df31c82a647b351a8f39daed86e6c2d3eee02548512cdcd9a88a1e8528bea8f2e6
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB