Analysis
-
max time kernel
140s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04-02-2024 05:47
General
-
Target
2024-02-04_af969623e305b65bf8bfa498bd379d72_cryptolocker.exe
-
Size
53KB
-
MD5
af969623e305b65bf8bfa498bd379d72
-
SHA1
1e9af1c561e5ade865bc82ab9542dc9779bd4429
-
SHA256
c305737d2c9b09cc938515d25af487dbe45615b4208be9a13f89b3661fb8da9a
-
SHA512
3fdbad972fd933d108788a758e0ed4515e2defef54e7c203c90583ee81d3213402b91cc10e492cd7254ce91053dac22f1f94eeef2a4f3e06f558170fde15868a
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7i:6j+1NMOtEvwDpjr8oxEo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_af969623e305b65bf8bfa498bd379d72_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_af969623e305b65bf8bfa498bd379d72_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD50a1ad391fa504169cd7ab1b28cbedd0a
SHA1e5cfff1b6ed42e477b4f1b6dd2a5dfcfbaa388df
SHA2566b6d67a3a06096e0c7063e964ab2448d41598c4967c4e9c233a84e9d3d621184
SHA512ce24a9194d1a52af98d9f357acf006f4cbf8f6467d6a15234c91e4c764bd091240e1977c0fd01eeccd4bce93e691cc6b93a4f68b9affe2e5cc6de96c1aa0610e
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB