Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11-03-2024 05:37
General
-
Target
2024-03-11_528c37623e938082c874e137ae4f9559_cryptolocker.exe
-
Size
61KB
-
MD5
528c37623e938082c874e137ae4f9559
-
SHA1
6af49461012dcb36c7a8537c9f907cbe97f0dda4
-
SHA256
9b5762531708d403ade873c446c34677f24dc5ae947480731a10bc5a839b1a7c
-
SHA512
dbf148617717e455adda1ab2cb3957d1c350f5028b0e11b7235dfefe9d0a0fa944e049d62e9eb5fff3ad70219a76fa190d932eab520cd4fa88a859568df64454
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMEjT:TCjsIOtEvwDpj5HE/OUHnSMZ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_528c37623e938082c874e137ae4f9559_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_528c37623e938082c874e137ae4f9559_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD51fd7d6872f51da0fa57e5d47c0522ed7
SHA19270c319fb4a8c014ec49ad6b294c57434693e9f
SHA256fc312e53baa0f6e797d6aa752cb2844d3f0e0d9d8967891f8ac387b1488e2c80
SHA512ba1a8f0223256ef2f219030d497f6b4d3643625841119a5d2596cd915c7e762a040240d9be8aea0431b77cf52ec957f8261023ffe20565dd0b5fd582d7d56cdf
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB