Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
08/03/2024, 19:37
General
-
Target
2024-03-08_7f3329a952ab6285632941caec49a069_cryptolocker.exe
-
Size
41KB
-
MD5
7f3329a952ab6285632941caec49a069
-
SHA1
93b01c66fbcf1defb9834d315fb61060b5633ebd
-
SHA256
f0f1326f42c64fb7d69b6e226139e3be52b06d45e6bce206894977bfde77d274
-
SHA512
70d64aa344226e1fc838b2ab776daec11bfc0e58e176980b7be6054225bb7fc6a956b28eeaf8dd5b897e72194d34247d931d13a38cd5e94ea3404e488d199605
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtXfNg:6j+1NMOtEvwDpjrR2XfNg
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_7f3329a952ab6285632941caec49a069_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_7f3329a952ab6285632941caec49a069_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5963da1dd60e7d942a3d8a41e0ff8a539
SHA1c56cd91403dae032142fbbb47168a79fdc040c89
SHA256cfe86188ef4c6a00a1296a8867f5427c3f2181a19aacb475ad6b563efe7253f0
SHA51282a0cf1f561326b59df5492f2fa0053c73a6d38c377c7fdd3e1852c9d2bf5545f2741e0481f25ec363143f93bc7efb32adb6ae6c1cfc8ec464f4d234ea3c8637
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB