Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
16/06/2024, 19:22
General
-
Target
2024-06-16_1b8ab109f477845a5f4137c4337d2632_cryptolocker.exe
-
Size
86KB
-
MD5
1b8ab109f477845a5f4137c4337d2632
-
SHA1
8d60bf574b173b66687a4ca5b7756ee08c08f16e
-
SHA256
cb06630f7fa21f293ded6c79237a9d9bf811748d7693dc528446e593774cb6de
-
SHA512
690da037f4094df748455f667475232114d10d6ffa98dbee140ca97c19bfb9038db68e083246f2fad7718fca5077bdef63f07db24dd0824e463c589746d06f97
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrC+a:TCjsIOtEvwDpj5HE/OUHnSM4
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-16_1b8ab109f477845a5f4137c4337d2632_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-16_1b8ab109f477845a5f4137c4337d2632_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
86KB
MD5fd91c1b6882d4a8c82b96520e068cb5d
SHA191b6a6d9b779cfe3b4a307973f6be5ed977de13d
SHA2563f6abfef77c1fa8ee6e61ef1cc5ebc20538f8d0117666ed06404237d50abbc92
SHA5124d55c104bb427c67c2cf26a7efdb307104ac0ef7cbc91d1709d33a5f33bd57fa706ee18a27f66f00aa7edddd7fb8f6caf648ebd77e691a078afb234720e6a152
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB