Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
27/03/2024, 22:32
General
-
Target
2024-03-27_8c52f407a441c1daa28da4f151e66c38_cryptolocker.exe
-
Size
94KB
-
MD5
8c52f407a441c1daa28da4f151e66c38
-
SHA1
cbe145c0458cbb6c24348206a445c9bf74111d91
-
SHA256
609a09354f4312268d16cf6a647a9fa4c3c5d2de6a650958b51929d49dea5292
-
SHA512
ef4a2105fc484d06950567f02846c1fabe684372b9cb478e035e3921f7a4c3364c48ae800d04711f2afeb6af81876bcb67957909f6ba947ddda2827c05239771
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJ3M0:xj+VGMOtEvwDpjubwQEIiVmkx
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_8c52f407a441c1daa28da4f151e66c38_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_8c52f407a441c1daa28da4f151e66c38_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD59db19c5c434e08d965201c1fc70762e0
SHA1a847a27fb045d959a151b6e67f60573bc306307c
SHA256596d7493cc7f3a3996be6c2979c25c2053f6d688c3ecefc921ab9395d5ce9037
SHA5121783b283905ac438600b70404a59963fa5a3bceb858ff50fbe9561a9135ac531ec6db78805efd826253ce0d658bcb81f2fd46f14d56043699755d271d7eb1a32
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB