Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08/03/2024, 22:36
General
-
Target
2024-03-08_fdf38639a741afc73cf5b697ffe2d4a1_cryptolocker.exe
-
Size
61KB
-
MD5
fdf38639a741afc73cf5b697ffe2d4a1
-
SHA1
ba95d1c3b0076b63761485805fcdb14765d37a38
-
SHA256
b93d7e772859a1c81ba7a19e41766724ea2db549b88ba383e8e891ac9dd23128
-
SHA512
8b68fb4714315e1ed30ac8775ff037608e183a022f2e966cf4e0ab7785834190d2aa27368cc9c6aaf2b4590518ab079ba82a18d66d40d671675573031e8ee943
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEiNJ:6j+1NMOtEvwDpjr8ox8UDEi7
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_fdf38639a741afc73cf5b697ffe2d4a1_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_fdf38639a741afc73cf5b697ffe2d4a1_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD59a85e4e43fb5500cc11ab4202c619ef9
SHA1ea7653a9b5721a53efbe4eb552ea25975e770605
SHA256f0dd337778205338c9923282f9768f963d23b724bb2492d61c6e7f0fa6aeeb90
SHA512d1b820e4e043b596252e1691f5dcc81f3b735eff194004d354c3c4fdefc61e14df509ae7f37d72a84f061b65680acf43f759a0633051d4c184c2836ed024c092
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB