Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/02/2024, 17:23

General

  • Target

    2024-02-28_6cfaf40a23ca9e43230efce139a13772_cryptolocker.exe

  • Size

    49KB

  • MD5

    6cfaf40a23ca9e43230efce139a13772

  • SHA1

    b69fbba2c49b876a81741e43126a723db37b73e7

  • SHA256

    1159c8afdc59951ac15c79c4784d270cab54af563aebb9eeaf5e12915c76d0db

  • SHA512

    c3ab1d74830e8a9cf1df9473ad2e07a5adff3c6810cc21dd21b7458ba373af2481a282fa8937e79a824505d2f0bb94b1a1d25cb02cbcbf858807e68c9f838fb9

  • SSDEEP

    768:XS5nQJ24LR1bytOOtEvwDpjNbP/0GeUMxI:i5nkFGMOtEvwDpjNbXdeUd

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 5 IoCs
  • Detection of Cryptolocker Samples 2 IoCs
  • Detects executables built or packed with MPress PE compressor 5 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-02-28_6cfaf40a23ca9e43230efce139a13772_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-02-28_6cfaf40a23ca9e43230efce139a13772_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:376
    • C:\Users\Admin\AppData\Local\Temp\misid.exe
      "C:\Users\Admin\AppData\Local\Temp\misid.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:3160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\misid.exe

    Filesize

    49KB

    MD5

    581a2994d6898b133c2ca7b0339f7ac5

    SHA1

    85c9ea27e8f51e4687d04a4875d1e628d82b2b66

    SHA256

    d29cb5c2728bc3bec6b9a927e950578c994ae9a071ce574c6e8e44128c09090e

    SHA512

    c5936fbb80d0ef9231a89e828b37189ffe3a81f7a18891a8e931cdcf918df83abb16cbdfd2c58dcf6898224e3e2a3dac5deacbcf03e44b28071ed068ed7610c4

  • memory/376-0-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/376-1-0x00000000020D0000-0x00000000020D6000-memory.dmp

    Filesize

    24KB

  • memory/376-2-0x00000000020D0000-0x00000000020D6000-memory.dmp

    Filesize

    24KB

  • memory/376-3-0x00000000020F0000-0x00000000020F6000-memory.dmp

    Filesize

    24KB

  • memory/376-18-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3160-17-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB

  • memory/3160-20-0x00000000006D0000-0x00000000006D6000-memory.dmp

    Filesize

    24KB

  • memory/3160-21-0x0000000000660000-0x0000000000666000-memory.dmp

    Filesize

    24KB

  • memory/3160-53-0x0000000000500000-0x000000000050F000-memory.dmp

    Filesize

    60KB