Analysis
-
max time kernel
153s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/03/2024, 22:43
General
-
Target
2024-03-10_1185a708be53733ea117eca9e4e2d975_cryptolocker.exe
-
Size
39KB
-
MD5
1185a708be53733ea117eca9e4e2d975
-
SHA1
e778e2018b9b3c99aca660ed606a631dacd8adca
-
SHA256
4cfcd5b1ca771aa86ebe709d0414f5249b971aedfc22e4aef8f06f097302130e
-
SHA512
1d31e60d474e3996814fc8eaab35ee0204afe756ff0bd35fe7200a11a1b74cbc882b5f8c32c74630bd8054cd2646aadcbde895ed8617aea185f91cdb351210b9
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLtldJQgcS:i5nkFGMOtEvwDpjn/JQgcS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_1185a708be53733ea117eca9e4e2d975_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_1185a708be53733ea117eca9e4e2d975_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD5882773966717c666ced41fc764bc2e32
SHA149111929adbb78b576fec93073edcbef54a0cbf3
SHA256cc325e0a515b4c840a8183c14f31e9c6e42fc62d86927eb703d45a7259a4a70d
SHA5121edcf54c53ce87add786efe5e423956a6af9dec77f469c47af27e0a418e166e648cc2f5968bcc05632f4cc9424b230f2cea2fc5f6b52667c8f6c6a419ec5a76d
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB