Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/03/2024, 23:21
General
-
Target
2024-03-11_1379e7507f83c67e2e23830d40caac98_cryptolocker.exe
-
Size
49KB
-
MD5
1379e7507f83c67e2e23830d40caac98
-
SHA1
a71aa0479b504bf3300ed8a70951357b06dda35b
-
SHA256
22e3ea87ca5552c1f1956b3cc4d5588ece14249f53ed838c66d2d3947d690e0a
-
SHA512
32977a000a2148057b2ab01ddc73605acd8040525d6ffd5605c2c875274a325cf8f110e83b47151da00322a2d67eacfaf452a98a469cb40b1bf15c6bbbd5f56f
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaN5:xj+VGMOtEvwDpjy+Tj
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_1379e7507f83c67e2e23830d40caac98_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_1379e7507f83c67e2e23830d40caac98_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5e2ef06d5a59944cd022da76db5034bd0
SHA159f7828c666efdf7ac8dfcb36c39f5b159345765
SHA256653389f2866f691ba6defa2d3f94fd290eb66f7e3a4d4dbe32734e32e11e66bc
SHA512c0ba47e1d3cd7ad49deb2ec31f1137d74f7142a4827fb2bc80737bf34270f130fb8000f4a8448e2109b5750ac0a5574cb7e1c52b78f75ac12a29fb6d6c3f4040
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB