Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
26-03-2024 22:40
General
-
Target
2024-03-26_bf2bbe85a02d02b96f9f630d1ad6b54a_cryptolocker.exe
-
Size
64KB
-
MD5
bf2bbe85a02d02b96f9f630d1ad6b54a
-
SHA1
433e0a4cbf39ef0818d707cfa610c820720fa95c
-
SHA256
43e8fc82491a5f6795567a0e56091db77b36c5e9a3bfc96da2da548364966c0c
-
SHA512
72c2cb288d05e174a1443701835375cf5badd03608407c1cd9788c2eb305ea007238cccb1ee2f21611f257eec725fcef4c26a7c96987ad31a3b4b4aee1e04955
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEKIRo:6j+1NMOtEvwDpjr8ox8UDEKKo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-26_bf2bbe85a02d02b96f9f630d1ad6b54a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-26_bf2bbe85a02d02b96f9f630d1ad6b54a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD5f9f1277338f3de5a4ffdce831dc3e405
SHA175ac42f3274daa9e8da85e3f973aa79e548b6328
SHA256e81a201182d39031df26884b136f36b46128d48f8c12b68163faf58bf71b8f9a
SHA512b588af3fc3bbcfa24b768cb66e562ad00b7fa5acd168acfdf0efc32610a02b51858801751c15c8f9e91aecc3b732603f2395db5db67dbcbf3dbf0798c70d5bb8
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB