Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
27/03/2024, 20:44
General
-
Target
2024-03-27_c703fb262c35904e89e6fbc0f0b4a4dd_cryptolocker.exe
-
Size
40KB
-
MD5
c703fb262c35904e89e6fbc0f0b4a4dd
-
SHA1
f332315872741471a659125d90283c1ac87bfe7d
-
SHA256
b7df36b150189281c06ec07235573235a3f29213c9c104f3283ca82dff64fb33
-
SHA512
cb563fc8c29c09d2aa172e203e9e4ec605208a1f37bb9e0e1b486b8b229c2f1cfe567cc3f64f01ba9107f870f733188278cd25aea26b3d1b5d683be807b80b5a
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLbjG9RzhwaO4n:i5nkFGMOtEvwDpjR+TZ
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-27_c703fb262c35904e89e6fbc0f0b4a4dd_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-27_c703fb262c35904e89e6fbc0f0b4a4dd_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5846831b6b282c6d816b430d8c634f248
SHA1bb5d196ac0c36ad5a79a4231d82ffe4242c14e80
SHA2560db24c2a8f29dad56beb1fb6d098a1167a9c7242a2b5288f2631ae75753fbeb8
SHA512e31d07301bebc49ee8b1db3d6cebb31a50c1d4fa947cee621ae4c8a1b04cae5e363e30034f9f2def2831fecfb3ea49b5d15cbcb2094b6dd3f1526b946d507bba
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB