Analysis
-
max time kernel
139s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
17-02-2024 10:41
General
-
Target
2024-02-17_db15d7b15d075d5d5b26c31322426c74_cryptolocker.exe
-
Size
62KB
-
MD5
db15d7b15d075d5d5b26c31322426c74
-
SHA1
44c0b4b54d92546ef22b2a28773a10ec13fb2866
-
SHA256
197d2a9fe8aeedd7b3d6633706bd8af2065c2ef4fab8504555f7ec3ecb86994b
-
SHA512
61583d1fe277e88e8b2376f2fef8631579372df787849723d84c70eb0e6d0542704e9372ad37f41fc392c461ac63f6447dc3a1f1af8ea8b3e8aadd399188af28
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEKLL:6j+1NMOtEvwDpjr8ox8UDEKH
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-17_db15d7b15d075d5d5b26c31322426c74_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-17_db15d7b15d075d5d5b26c31322426c74_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
62KB
MD5a6e42d60c2ae1b59179091a184b7158d
SHA1e0f5c4c7830432d128eb9126ed578a61147ed1a9
SHA256f47d877def3aab74b261ca17c5eea1360cb4e3481bbcd1b1f872b36d29860760
SHA51283218bd49e6511335a3709cc182bd665768784d07aec8e0ea4935ba553f4524279ecd72f356c4f658b0be9e3a83a8e4df3b6f76ea1c31b4f7909844bda55f8f4
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB