Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/03/2024, 10:49
General
-
Target
2024-03-08_8cd4104f7f383196edbec61e5f392443_cryptolocker.exe
-
Size
95KB
-
MD5
8cd4104f7f383196edbec61e5f392443
-
SHA1
bddba18b87d2059b919f9aecc2815dc6639b9046
-
SHA256
2a44a0f3512a42ff054ea83e95e33040f6a6e2caca9db7165228068049066f62
-
SHA512
bc7abf9c49bd8e386681aaf01c959045d462d6d7fc0d649aad698549b3f360b598ed6efa703ce0614b773bd57f8a370affdb122d9870e719e90cd89bda1d89fb
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJW70:xj+VGMOtEvwDpjubwQEIiVmkq70
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_8cd4104f7f383196edbec61e5f392443_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_8cd4104f7f383196edbec61e5f392443_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
95KB
MD56061ce4890360d1765ddafe05e6fc462
SHA1835ed89d33921d9002d0a21dd8b05581db60bd26
SHA2561e95715468ce010869db4587eab8ff44975d99a1b594da914ccd743033538042
SHA5122857de7a9bccf243a8844bc312f9219c8aa3eb7e76fa3b98e80abb4f5c7758692fb281bf5b848dfe5dcdef09267d17aa7d21ac8e38e53fbc36a8df11f8da8812
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB