Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-06-2024 12:48

General

  • Target

    2024-06-13_d6313f81f3fefe7ba975ee557a9fbfa5_cryptolocker.exe

  • Size

    42KB

  • MD5

    d6313f81f3fefe7ba975ee557a9fbfa5

  • SHA1

    d0bfaa35a12731ba498cc2fcff06001a4b76d3d5

  • SHA256

    dad68d5c20fd940f28a319474cde46444a36cf353b12eecf400730745fa7f763

  • SHA512

    6384c73961da5719ece5af433b20190a725b9f084eef711b17220ca124febad5a383948fcebb8c0aaf8ff86c30e9400430622fc9df8a5eaf6aa8d112a1ca5a2d

  • SSDEEP

    768:UEEmoQDj/xnMp+yptndwe/PWQtOOtEvwDpjLeJAsKuDb7xfu:ZzFbxmLPWQMOtEvwDpjLeJAsKcb7Zu

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-13_d6313f81f3fefe7ba975ee557a9fbfa5_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-13_d6313f81f3fefe7ba975ee557a9fbfa5_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1780
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Executes dropped EXE
      PID:2348

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    42KB

    MD5

    38f8e2281f871a0223d64bdfb51e38b8

    SHA1

    60b6dd562e0425ddeaac9fe614c84354d44794e3

    SHA256

    cbbd1a435934bb1caa8b6c9de2ea103e87b7a7646c6a46cadffe252e971ff647

    SHA512

    1b2852cb346858916c0c772fcc72af1675a9051565589a498e967cc2009e9b78b71f847934d9965d5afffa35bde11b6ffae8e4bd36a6126cf8df52ebaaf83f2d

  • memory/1780-0-0x00000000004E0000-0x00000000004E3000-memory.dmp

    Filesize

    12KB

  • memory/1780-1-0x0000000000620000-0x0000000000626000-memory.dmp

    Filesize

    24KB

  • memory/1780-2-0x0000000000650000-0x0000000000656000-memory.dmp

    Filesize

    24KB

  • memory/1780-9-0x0000000000620000-0x0000000000626000-memory.dmp

    Filesize

    24KB

  • memory/1780-16-0x00000000004E0000-0x00000000004E3000-memory.dmp

    Filesize

    12KB

  • memory/2348-19-0x0000000000750000-0x0000000000756000-memory.dmp

    Filesize

    24KB