Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-02-2024 11:28
General
-
Target
2024-02-18_1a0e2f07bb869fe1e36e8336f1c23a30_cryptolocker.exe
-
Size
47KB
-
MD5
1a0e2f07bb869fe1e36e8336f1c23a30
-
SHA1
2b28282475246cc98952ac286f08261dd1116715
-
SHA256
3484879ea9ec5a3715a3f65169e8013cf4f3bb2a7d95dd3fb7de849ec7c16946
-
SHA512
a11dd28f18a09cbda2843c7090e474088b32e07ad24a311f832ef0efc3c075d3a0bb154232df579d26b8e8913cdc217d3b81aaa588cd41e4170ffa845e00d489
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRD:6j+1NMOtEvwDpjr8hhXB
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_1a0e2f07bb869fe1e36e8336f1c23a30_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_1a0e2f07bb869fe1e36e8336f1c23a30_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5f52a36973234eb299765566caf56aede
SHA11d2bd3bc2739b60f3961db7fd1eae937cdb81ac1
SHA256186de51001216a62db164ed2d2707d4f2bca247d0806a44d403c3492e50ddfdd
SHA5124debe36b176200cedff946d2b1b7ef2d4a048de30b67b0fc8bb82378fce5f76134c7036ee6708b0120cbe0b9a064a8c691eca90543c6206c7acb250bcfc87988
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB