Analysis
-
max time kernel
92s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
10/04/2024, 03:46
General
-
Target
2024-04-10_9286683faa90a9e9874b198144b78b0b_cryptolocker.exe
-
Size
100KB
-
MD5
9286683faa90a9e9874b198144b78b0b
-
SHA1
1480d36958c6ab6eb4c370db64142c7d346cbe34
-
SHA256
4a8888b9ce741805e9f5c0ec3b43f072cd13ec56b80ab88804506c48b5b5b2be
-
SHA512
f294f63cb59f16be073e7a152da998f9dd5a63924b2776cf070c19db5e85603aa16d24175069e5b13a7a4c28ae354097a717c79b30091af930e0a8e5066f9a2b
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJHlv/k2zR:xj+VGMOtEvwDpjubwQEIiVmkxv/PR
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-10_9286683faa90a9e9874b198144b78b0b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-10_9286683faa90a9e9874b198144b78b0b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
100KB
MD56dc6dd1fa15130e109c7baedf5e08f77
SHA1cf282c0a3ca031aa583b1cd46dcb1affb6043175
SHA25614e5ab3f52c74582f1e60a0f0ef6bd012fc95f63d340577781dc3418e4df84a1
SHA51266d5fdf10bc53e0275c00f4f2b99a803e8362fa5c6c9a25af6a34a8d8f39367e6a96c70e305fbf10e467b286cb77ef6bb699902a577b720d551307cf1dcd963c
-
Filesize
1KB
MD51316f214df3f2651af58dfa07ba01891
SHA137fa8f4121a64f8e23e3859967fba233f7786a5c
SHA256f5b5dfceb1eb19ef78efb7e25192be9c25ab07ed0330a1dc61a12fa04c6e182f
SHA512e9e15f2c8ada607d7939864341a23378399478f1156ebebf4ba561eef979eaf922a53730a28aa97c51dcdf8f19ab60c3a8e9f7036c5cc2629526db15c8fa80ed
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB