Analysis
-
max time kernel
87s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
01-02-2024 21:02
General
-
Target
2024-02-01_3a9cbf10d38e01f108bc57af9cecd32a_cryptolocker.exe
-
Size
80KB
-
MD5
3a9cbf10d38e01f108bc57af9cecd32a
-
SHA1
109fff8f2850de9998e8a417bdb9816ae115cc33
-
SHA256
a0f44f7255c1c96ee4f5ce855f3825b639340815e8debd64603121354ccd41b6
-
SHA512
1023768150d4b3526da0226cff7ba522ee285d305cedc870a7dbb1d098a7391a31d58ad4cb58da5240f11c452b1971d08bd9c917fa31823ce9cd9c019209e68e
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMM9:TCjsIOtEvwDpj5HE/OUHnSMj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-01_3a9cbf10d38e01f108bc57af9cecd32a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-01_3a9cbf10d38e01f108bc57af9cecd32a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD53780e3b2810a0513e9b77a965cbacd28
SHA1eae9d4dbaebf29d18e297258059435c4cba931c5
SHA2566500452c5bec4362396181269b9c1e49528ba74a7c135b98c5945f05c906d6c2
SHA5124ac77601ee39d43f8a14a8bcc7d32832eb8c9d7468c07d033901dcb48f3a3ae2d41f1cb01f5aff260e1515a9e4c0712f0378fc3fe28130251d1c26db3f19dce8
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB