Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
11/03/2024, 23:26
General
-
Target
2024-03-11_4d858e3f434a4cc64e1ab197a199e594_cryptolocker.exe
-
Size
39KB
-
MD5
4d858e3f434a4cc64e1ab197a199e594
-
SHA1
91898de39a4d5e65cd189247891a7282d5cf29aa
-
SHA256
9bc04c729a9413d451f38ca7787cb39906c6dcc06d9aff818fe7d57253484b43
-
SHA512
9895bafce2052f7f58473e69af22570efc5b24777109b6def5e949ab2fd457dc4349935148555a63579847ddc4d98e5bdda36b32857b4c5e514dc8b04805ae44
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnYY:m5nkFNMOtEvwDpjG8hgpYY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-11_4d858e3f434a4cc64e1ab197a199e594_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-11_4d858e3f434a4cc64e1ab197a199e594_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5c02cda5b877843e0defff0de677e3ace
SHA1a5954af237a95e93bfa2c35347a6a589b30ecdb7
SHA256f1e208cc438f2043b1435077e48e61d2b827385f6c740356699caad584e0b2fa
SHA5120a279663e92e0c4ebfabdd89ed1efe09229e9917578da54926db6b83fc33e94730428c5003d694b63c97dba7838ab055f46068da26a626cd611a3f0db1a7e757
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB