Analysis
-
max time kernel
138s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
23-05-2024 19:45
General
-
Target
2024-05-23_f1e5b2025a0aba614bcd0f1fd726d4b6_cryptolocker.exe
-
Size
67KB
-
MD5
f1e5b2025a0aba614bcd0f1fd726d4b6
-
SHA1
1cf9920b03a4c0b484b0e20c5804836ea32316a2
-
SHA256
07e772d11e86fa19cdbd24a2208435270231d54bf729235450006210b379b0f6
-
SHA512
864653a9796d44db39e6c8765890ad8ce0c0f1f757ba0f583643564b6bef1fce6ec020c90880f8ad8681de90fcda96f29b0b978418b99630da7e77223c62ce0f
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2l9tMPvdfGyePE:TCjsIOtEvwDpj5HE/OUHnSMYu
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-23_f1e5b2025a0aba614bcd0f1fd726d4b6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-23_f1e5b2025a0aba614bcd0f1fd726d4b6_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
67KB
MD55a8550930e53e33680a3e8a596c4d390
SHA15b50432b808f467ec084bd22ea310b9525c4d9a2
SHA256cb22b5709af744b2a8e538a5be3fd4677121d2c91a6aa0b76706bdc928cfecae
SHA5123ec8016616c7fc208269f6121ef701667b57bd9b13ad9741aa36085a0a66a0323866dca7ac98b2bb28d7b02c0d611540d50d7c9fd30d19bf916e50a0acd5e74e
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB