Analysis
-
max time kernel
88s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/02/2024, 14:33
General
-
Target
2024-02-04_97ea5652ba756ddc9330356658a4cb83_cryptolocker.exe
-
Size
56KB
-
MD5
97ea5652ba756ddc9330356658a4cb83
-
SHA1
441dabe2e64a31fe388d95df290f45416219b860
-
SHA256
0b6543f30bab3b0da4b6169aa586703c69caec43d8ee2a04a8ade4ca289f2921
-
SHA512
109d3e1146e5d5d10aefb085197c5d3e98bec1e98cf050bb00cd27c02d70c536085653ad363d5035bf67da980a3bf3ae4f986284b02d61e9911350029220de6a
-
SSDEEP
768:zQz7yVEhs9+syJP6ntOOtEvwDpjFeV0ZOfcpyF:zj+soPSMOtEvwDpj4yo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 6 IoCs
-
Detection of Cryptolocker Samples 6 IoCs
-
UPX dump on OEP (original entry point) 6 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_97ea5652ba756ddc9330356658a4cb83_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_97ea5652ba756ddc9330356658a4cb83_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD55031861b45400e46f69076e036823ac6
SHA1a734b25221406146eacb171a21f09e06eec68294
SHA256f10885952a18868c6f5d9ed20a2986e0fe87b731231d11170273ab9d4e08bf9c
SHA51202f1bbf4d17605cc24946a616b284a0337870f8c3cd73a2d3bf426ed88f5d43f712b779f4aff116dabb1dfa024f0ce185d43bcba0c316ffc8de929cbbe5784e3
-
Filesize
56KB
MD5588eef096537deefe1d27f640cf8f792
SHA1ced275900fe3c783758080ea0d819b44170f49cb
SHA256fee8bea983b982974c5f6f9dd452b615974d91475fb90459a3562b34d55a78f8
SHA512e61a84f540df5f7d95b47468f86bc59d8241b7515b4c7fabd6198661b2899d6dd9e3b8f20767a6777bbf8251eac6de1253f481cc1db4211b8384c53a3b949cd5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB