Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
15-03-2024 06:28
General
-
Target
2024-03-15_69a4babe9f930fcb81930cce366597cb_cryptolocker.exe
-
Size
58KB
-
MD5
69a4babe9f930fcb81930cce366597cb
-
SHA1
2e538ea33e2517906c40a020200354cdd314fa4d
-
SHA256
22f5674a37f84549ce13d748e70036b233b3c8df50c13fc6cb558500b50ee6c7
-
SHA512
17ea74e8d07f02ff8f8dd6e93fa08c85134278bda32836f5510c5e55fb93e6ab138e64708b433899267b16605f57bf22355fc29a1a3aab632f1453713a9f44b7
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbP/0GehR:xj+VGMOtEvwDpjubXden
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-15_69a4babe9f930fcb81930cce366597cb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-15_69a4babe9f930fcb81930cce366597cb_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD591dfa61b0aabdfe6a9eab1df69bb6e53
SHA1fe51a7e0bdc9e5cbada19a755063ea3e3e66aac1
SHA256c6b7372e45180daf4a92b5e8578d5dd05bcf3523d52cb3f6f5c9198606421c42
SHA51203a5545846c21c3cb47b2e199656db93d5cd48742b1b4ba36c7a7a425d1eebd54a2e346c46f0bdbacdc763073b19248c4f8f4a54567a542f92ed80685d31b05a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB