Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10-04-2024 04:35
General
-
Target
2024-04-10_45d957ecb133c495d1d3610d27b9a1da_cryptolocker.exe
-
Size
81KB
-
MD5
45d957ecb133c495d1d3610d27b9a1da
-
SHA1
5c7b168f7a9d083fb904350b5d971e404e7e074a
-
SHA256
ce196f0f917ce71ecf86ef0e22976c7e16f957ed317be38dc4e6149f0d8c6f34
-
SHA512
25a4f9ce31f7f17441b9a595271fd360de3547af35d77a8185916f78556ff8d173a80ba09d6dd5e1d65fe3a83ae64773ad94b5db95f6ad63f7b1f0357d7de26a
-
SSDEEP
1536:zj+soPSMOtEvwDpj4ktBl01hJ0tq1ky7Qp2CEd:zCsanOtEvwDpja
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_45d957ecb133c495d1d3610d27b9a1da_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_45d957ecb133c495d1d3610d27b9a1da_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
81KB
MD57b5fbde493f046da923650c01388966c
SHA1f4038f08df9fcbf51d1763f80d0363d23999b460
SHA2562b54877dc42e67f7270838ab0cb1931879094f7987e8be10bf1b6a53a5bc0ef2
SHA512f4c4057545a53b7acf21ad392e260502f0398bda43b75095581e4f49106f7404e92f38ff2548545d1cfe23d467e47ea1121196a0817740801d5dcc57e261cf76
-
Filesize
1KB
MD59949f4bc62e90d7f50f070e594df3c6a
SHA17170c5d3d0eb8354b27385e853f3db70a756712b
SHA256eab657c58a68da74b9730875d51a61657dfddf7cbbd921e154e26b338c20a31f
SHA5128519109c6db5692574edae48b5e308bb708fe94f1d85379941ad26430995d059875482baadb18dd51f6d75e121dd182ecef9d61877b42dd4178bc5c1684db38d
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB