Analysis
-
max time kernel
139s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-02-2024 14:43
General
-
Target
2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe
-
Size
49KB
-
MD5
3435b13de3832d85b630578c45876454
-
SHA1
c9f95b1ff9850a8f00bff008814ac1496d0ce8ca
-
SHA256
ca59a8044c256586ebdb419e58113e4098460a3619fc863de8381045b425083f
-
SHA512
6c8142eb79edb7429b33fc8e02da6a299d85c1539af6134eb7345f3c6d1c9006834294b6f3f1e74bcbc54864a6861f7547a0649c353ba369e4010bbcec146dfc
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvgpnuQ3SzjRf:6j+1NMOtEvwDpjr8hgpuQ34
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_3435b13de3832d85b630578c45876454_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49KB
MD5947c8daaab00c33cf088a3a20a62b108
SHA1d77473cbdae2fd3f68f4a774b97577d3977ec3c9
SHA256aee4e06faaffe0df451f46bcaca4b0d719652253947868c7872cf9c524351c08
SHA51223f3b78dd3750337a103204d2dc953d688ea68d8b7c54fe86655040fc3f5a305a849f485e6fb32d0f00f6b7144a3e2ff53bd439b636149af9a3bf178012c2783
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB