Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-03-2024 01:45
General
-
Target
2024-03-10_48b043f5e822bec06cac1f7e94d10fb6_cryptolocker.exe
-
Size
40KB
-
MD5
48b043f5e822bec06cac1f7e94d10fb6
-
SHA1
c2afe62bb81b6cf97811ddb26660f4faaee5d6b3
-
SHA256
e0f2f3ff66adea72666265115f26d1b40b4d12ebf2d89220fcf2ee91d617ba2a
-
SHA512
f92039e733525df3b80fb98cb99548c9247ca4cca05188d9a6bf616f2f547beee27a55b722e198ce4e1b1afe59597dc3263ac105fc0ddf9df0b1d6b495240b94
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRnw:m5nkFNMOtEvwDpjG8hhXO
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_48b043f5e822bec06cac1f7e94d10fb6_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_48b043f5e822bec06cac1f7e94d10fb6_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
41KB
MD58d6121615e79a9657c12b8abfc734687
SHA13f47492e72249cc49ec58bb22afb3b22e92c95fd
SHA256c2b325b6758941362c9f0f60b0a118b7880bffc7ba5e6c9a5cc886dd51b03a8e
SHA51220c0b0bada3428420518b42aa413aef454c053abb96cc3ce391e70456f9bbba86e4ec6814fc43f8525af5519e7b10be0b2a8a5f284fae65b7fcfab77f83d50bb
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB