Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-03-2024 05:46
General
-
Target
2024-03-10_1c1b9ac71019992890be41cfdd1cc262_cryptolocker.exe
-
Size
73KB
-
MD5
1c1b9ac71019992890be41cfdd1cc262
-
SHA1
0a214bb3e30ede4282b84377d5492a4888613ef8
-
SHA256
10fb881f2f8deccbb5ebca32f84a722f7cbb7c57b1a9a4351df46d791bd21b4b
-
SHA512
5402e83bb97f1fbedb391962a62260a3a21702176ceb91d0587d9a9972646df30f788af2c499af279ae7ca2b9c0ef169420f4a7330c110b1720e133ab461ac9f
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRXrZSUP2:xj+VGMOtEvwDpjubwQEI8UP2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-10_1c1b9ac71019992890be41cfdd1cc262_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-10_1c1b9ac71019992890be41cfdd1cc262_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
74KB
MD5d1689f18dc953513919c2187e3761e02
SHA1e2f9bc965d55814703fa6577d6157556258f69a1
SHA256e77d98810fb95e0c6845d3eaacadbbd8402bd1ff95943dd44488d6003523d009
SHA512752d0db837a651c02ea78d802d4068724652a02068e7ed30b3254e900ff4bc5c74e0be1c793d98e19b1250a18bc3c60a950fce2f3089c5da60b1714e6f86956d
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB