Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08/03/2024, 03:54
General
-
Target
2024-03-08_c578d638b7efdc3f40893fafe2985444_cryptolocker.exe
-
Size
41KB
-
MD5
c578d638b7efdc3f40893fafe2985444
-
SHA1
d6369a6b6d3d1d413018f3df62012a952ffc1df1
-
SHA256
f64377f44d899f6bd9ad33c44319de1ebf107b48df96c71a1f35a97a61fd45d3
-
SHA512
e2ff915262aba711c8f5c1da0d688af1295ee0004e9c600add42a87040e583cdb7dffddb34c63c0f9ab98b467dcc7f01b0adb22fbd32f89286c239b4c2ecb57f
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRTC:m5nkFNMOtEvwDpjG8hhXg
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_c578d638b7efdc3f40893fafe2985444_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_c578d638b7efdc3f40893fafe2985444_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD5a679443e925c5a1932643e1b6e905f27
SHA121436d25351b9e16d3ad48c26246e2cdd5ee64f4
SHA25690adca0687d5a2a42d39548307ad5a1fb1d11e8cc5ba7fdc096bab51e3967f7d
SHA512af09566c604df70e52cfa63b10e7ad9d4375bae1b9fbef155e8d5c437ad24a4f057e79da88949d34e5badb62e3b4cd2bd169ea4e3421fbdea2879faee4286f1d
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB