Analysis
-
max time kernel
145s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
04/02/2024, 17:29
General
-
Target
2024-02-04_779909c194820cbbd7597842e241c5dc_cryptolocker.exe
-
Size
61KB
-
MD5
779909c194820cbbd7597842e241c5dc
-
SHA1
6ca131919ff2f6ccc7098b4c79b5f0686df5f931
-
SHA256
ee8ea2a010450d8ac99ff17bacda9f02992345b5bd4e67b3f64e5a6daeece99d
-
SHA512
7e545944b2a70c5d91f625cd11aa824fafa6dbbd93ba1fd3051a85eac713767f555618a74e34d5daa9fd43e6748a557da9f24617f61175cd5aeb6986fde52746
-
SSDEEP
768:zQz7yVEhs9+syJP6ntOOtEvwDpjFelaB7yBEY9Su8F5mnVS:zj+soPSMOtEvwDpj4kpmeLmnM
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
UPX dump on OEP (original entry point) 5 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-04_779909c194820cbbd7597842e241c5dc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-04_779909c194820cbbd7597842e241c5dc_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD580817f91736a2685d8b305c5b47987db
SHA173f132afe1c1dba57d88b0e7ed6a3f1f77ed3a3d
SHA256f5d37d8ccfcc6876d1bf930a0d1afff1488e46da0881733b3e02d0f23294571f
SHA512d75c51045eac63f9a68eff8901918f48540da4715d1c57d0ed2a3fd38c1486af6de23d39d9fcc80696ebc0d3a7c9969872affc85582fb9702d6ede3002494426
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB