Analysis
-
max time kernel
138s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18/02/2024, 08:32
General
-
Target
2024-02-18_3c90e5769eff4ae2f30566dcd414d064_cryptolocker.exe
-
Size
94KB
-
MD5
3c90e5769eff4ae2f30566dcd414d064
-
SHA1
9e665b45cc6b5679b037d29f85ffe35ddc995e16
-
SHA256
611dc8fa7ee0d462d55c1b2a8f5a25e99c9a83e4fc3de0ca5113a34ba569a6c2
-
SHA512
f0e2571a44aee7b5aae2394b43f37bfc5f0caaacf75b49fdb3b9c3c7e7fd57023aa012445d2045369bd0b225eea308ad58fe5c906de95a60be76906ba5b79dd9
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJ3s:xj+VGMOtEvwDpjubwQEIiVmkY
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_3c90e5769eff4ae2f30566dcd414d064_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_3c90e5769eff4ae2f30566dcd414d064_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD57b2dd11e4c4bde6c102feab183b6aa34
SHA1909dfc9a7dd47681252e74b9d3bf42357dc833ca
SHA2565f2fde64d5451bb8f29ad97a3c33753017921fe08a823ed59895901c89fcfad3
SHA51260cb616b67220b7c3b5a2f4e30c237e5bbb1cfe33822b2ddd42a47f0c04423cf2f62ed3e2d1597d1d3fb8bc98b4ca42956958dbf8ed140411114040b30e632e4
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB