Analysis
-
max time kernel
109s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
04/02/2024, 14:33
General
-
Target
2024-02-04_97392e25eea6881d45b8c565ee2d0f60_cryptolocker.exe
-
Size
46KB
-
MD5
97392e25eea6881d45b8c565ee2d0f60
-
SHA1
40cf859ee40988ae20218be551e792152df7695f
-
SHA256
289d50d0025dc2db46b09ae599cf4df2ff827381a61c69616ce9d7de4edec890
-
SHA512
c5821b77e6dd290847aeb668cb83dd5f546ede29d9ab3fbae170e73052634300189cf81612a99dae1088a6d814c9a3e3224c2652cb0f42618cb746ba23dac612
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLtldedtg:xj+VGMOtEvwDpjk/eI
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_97392e25eea6881d45b8c565ee2d0f60_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_97392e25eea6881d45b8c565ee2d0f60_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD5af0ea950ac4af8892d46db798d3c993b
SHA1da895ef786ad507166cda47d952c6a933f08c1e5
SHA256856bf27d66391567663eee121a9b1b6ae46b19f7d2aa07ae5a9c45e704bf0cf3
SHA512fef61ceae372a667d330774be151400fb304784b1354260bd7fe8331fc4946974b3e5419ebf43f843262dee8e0cf7cb5ca176949983f1434a57252da5aace67c
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB