Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18/02/2024, 18:00
General
-
Target
2024-02-18_a956815c6381dce1c944fd566011517f_cryptolocker.exe
-
Size
40KB
-
MD5
a956815c6381dce1c944fd566011517f
-
SHA1
9ad436d02fe31240760ab1c6a95d98dcfade494d
-
SHA256
c50f18840b91a91e74ab8a94d5d5fe55a25adb2e11ddc55f58d3b1c528897966
-
SHA512
eee54658e62bf6dee796d971314f412388e4801fe1b6e7ce02139d3e086f57f9767c1e3f6914e627ec1b795a7c2e11d62699532895299a3adcaabc9934448534
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CtsC:6j+1NMOtEvwDpjrR2sC
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_a956815c6381dce1c944fd566011517f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_a956815c6381dce1c944fd566011517f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5a6874de6ff044cad478db0ed9ef399e2
SHA1c39e92fb6cf82a837c2b1f7861e666cfc82c5250
SHA256a449d1ea563d681f35097deeef8c326c8ffa865ce93477534901c772513a5e1d
SHA5124dd55e4f57ed18ff2c5640dfae31064dedd65c5b3bd7418098597efcf33e942051f9e23820d101ef4df880e0bf192491e9626b55daef3d27ce641f13ff51f70a
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB