Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12-03-2024 01:33
General
-
Target
2024-03-12_442a73fb34609c3d4b1689b87e7f4573_cryptolocker.exe
-
Size
81KB
-
MD5
442a73fb34609c3d4b1689b87e7f4573
-
SHA1
cd61f6dc1ba3dcc6f8a2f270e2ea3b087a680b9f
-
SHA256
b71104f8aec23fbb450c49f84209c7ff6dafef72a4cf0880894c8fa9605f8681
-
SHA512
7232793a3467b2c990b008bd720892f1e23345546831593c805e4e6138adfa9e3298c12043752e265efddbe918d5e8b08161fd173a3f6e82b442e691022059ff
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMAeN:TCjsIOtEvwDpj5HE/OUHnSMb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_442a73fb34609c3d4b1689b87e7f4573_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_442a73fb34609c3d4b1689b87e7f4573_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD570bfb3ca80b75048901cc7fcd6f64c04
SHA122c20f3829196a751cea70ce9b3ef6779303ca27
SHA256bc41350dd5ea3a12035dc0cb13daf3f43f166e42e03aaed28c1a63baf89b1051
SHA51286968b4ebb1f16f9dec695accf6af7fefc38855188dc8d8de1eac19b54e309513933df4667845100bcf6e73392ffa69c046975b48c3774170a2edfcc97e62262
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB