Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
27/03/2024, 10:45
General
-
Target
2024-03-27_e4687f2936a286a97a973ae363be0436_cryptolocker.exe
-
Size
40KB
-
MD5
e4687f2936a286a97a973ae363be0436
-
SHA1
2a7ceeb920e15f4bcd7336dcc47f66d0595c422d
-
SHA256
895fe052414034e070423e9e577f15406ee7755ff6bc9b364668fc06d9726728
-
SHA512
53e73c7237bd907b241bb7d7b154f11db58c5085d9371f58abd3ed0f445fe0c0841bfe52348f03f3240bdf2d181e06c3b4fef3b997087f1593db4d7cb4eec35a
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9RzhwaO4f:i5nkFGMOtEvwDpjR+TR
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_e4687f2936a286a97a973ae363be0436_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_e4687f2936a286a97a973ae363be0436_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD51fb312051ac83958c9fceb777b6145a0
SHA1c0214e23236d77bb3c423094a2d7f730187a2f9a
SHA256c782b177bcef7379e17ea26b6464a0bdbdf8f9c764ae3168a32b242b3e039daa
SHA512d13eb611b817e7de083f878dd3323c69ee1089fe6158b8acd45fd13b7f7b65ba6d89baf513e34c04464eb42beeaabd91b1a83b17f4ec861b339692df87245366
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB