Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
28/03/2024, 20:25
General
-
Target
2024-03-28_0b0a5b571d223244d39fd8dfffcc513a_cryptolocker.exe
-
Size
82KB
-
MD5
0b0a5b571d223244d39fd8dfffcc513a
-
SHA1
8eb152259c6f1b3d697433902efce794e298a6ff
-
SHA256
69446e6ae40427694c802a6d6fec006644924409828a4d48e370789861db511d
-
SHA512
952b626694ff8b13889db8aedaa4a96de2630955e029b70d1202802ef40c627a3f5d8877838196ce0dafd0d59a2e34acf35ac1b967238d1abbe24fcdf32bc9a7
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMy6N:TCjsIOtEvwDpj5HE/OUHnSMT
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-28_0b0a5b571d223244d39fd8dfffcc513a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-28_0b0a5b571d223244d39fd8dfffcc513a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
83KB
MD56ec46ef27747d3762de047ffd0016677
SHA1e357fe82cba777d4e27ff918f1c70c488f1826e2
SHA256090d8f4eb420337599343da8446f317201cdfbaa5b46c7da0d177689034a8313
SHA5121302d659ce756e0344dff05bb7d4bd6dbc45ea8f1f3fdd53cf5532d1f41ccd1a6fc46e06b5c18765b3fe5728b6ed99e5f505fe2b957ee94f1009f521f2618baf
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB