Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
11-05-2024 00:24
General
-
Target
9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe
-
Size
82KB
-
MD5
0dba9f1a07ab9ea4be2f6d17b0055c57
-
SHA1
8cd6cb7551ed9335eb876a94ee7c99083f4f9cd5
-
SHA256
9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad
-
SHA512
94f96cbf320431b5f03c3fccbfdc29f99b978eaeecfc666551837850f9cf3ae092675ba9f6e6a8cf968c43ae1bc972c3cabd375125235d6f8eb1ad7156d66b98
-
SSDEEP
1536:Tj+jsMQMOtEvwDpj5HmpJpOUHECgNMo0vp2EMMrCjh:TCjsIOtEvwDpj5HE/OUHnSMw
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe"C:\Users\Admin\AppData\Local\Temp\9a380f22decd7a4c5fc87187e6487ed515f0c497aabcd5ae2cc190f8fa7a47ad.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
82KB
MD5f6857d6048e00f433c4d48f526a39a4e
SHA11304ee80f1504e20269dd6a38e5155098927b853
SHA25648ed00ee2798da54ad5daf299efcca84b03e4f61a19b35ab054bc2143303081d
SHA51226824175d28f083733067476c0935d2144ec3000662506f77c9add8747285d389cef2185e7021b82c20f7893d0e923f115eaac0e97c6050d2845a9eb5790e49f
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB