Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
06-03-2024 15:53
General
-
Target
2024-03-06_e85b2e1dcd64f8cd95418f454823852d_cryptolocker.exe
-
Size
64KB
-
MD5
e85b2e1dcd64f8cd95418f454823852d
-
SHA1
6f588950b9a68dc81a26c9e6b6769c78d8a161a6
-
SHA256
21b51f6fe37db78b953f05ce0c8a9bee911d19788cdf6ffcc8f8aa4b8e92acaa
-
SHA512
3c2bdd9e7a97b790b89ebf8c38df2677b25830453c5957519ad77184fa16187c98b8e244b6a0e8af4bf56105ea727d2f480be1236a8459652d4c5b2bc0bb13b0
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEO10HP:6j+1NMOtEvwDpjr8ox8UDEy0v
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-06_e85b2e1dcd64f8cd95418f454823852d_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-06_e85b2e1dcd64f8cd95418f454823852d_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5b994744f27eca1cb89edc5f11feb2f42
SHA1769934199ed5587d6a5746ae71917ea1a36147dc
SHA256a8c66b4595cadecced94e9defb28a6b6c88ef296aca649e485a7534a6e973f6c
SHA512fd591a887d870193d9a9a605033cd45e61f4bc312afc806fb77ba6cfdc1f7b20b4b3d15505a5a108c73324858a2b799ca2959cbd1adaa9346fbc9ac51926c691
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB