Analysis
-
max time kernel
87s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
29-01-2024 15:49
General
-
Target
2024-01-29_81fc6e20f524cec835b30c10c12f5e81_cryptolocker.exe
-
Size
57KB
-
MD5
81fc6e20f524cec835b30c10c12f5e81
-
SHA1
7845a05a076167cf24d44fe669e0beee21961fe9
-
SHA256
c87f7959076ae2d68b2fb37eec1038521344188255fec5096f31d4f5c18bf377
-
SHA512
6b2aa22bec667647a01e6fc4d838156f4c7eb7eae50581bca13e8583a3f81f26283ef4d17ff21a016c34fcdf1a1c12dbfdb4762a131899ac5aa81ff2ce6857c5
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7Gowfj+:xj+VGMOtEvwDpjubEg8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-29_81fc6e20f524cec835b30c10c12f5e81_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-29_81fc6e20f524cec835b30c10c12f5e81_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5674781b70356f0eb525a3a035dcf7f62
SHA1265a4965878aa5d0b9080cecd0e51dd513d28b27
SHA2562c0f9d942d1b327c7930c9c562d29e6ec473fe5f299dd1a971b9761d8e31deff
SHA512bbae4d8be9e2f7ca8c8d086d511c476ef9cd53279539439eebc3917dc9ad159e2d19c624864eb02f14df2e6f0f0aef84fce86d08ebf0eb150c0ba32e6f7ceba2
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB