Analysis
-
max time kernel
136s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
18-02-2024 20:36
General
-
Target
2024-02-18_55b96169916a544518b917a80e61c7c5_cryptolocker.exe
-
Size
40KB
-
MD5
55b96169916a544518b917a80e61c7c5
-
SHA1
7ebf9d3e454dd9010ea9f3569cf36c2b1933c104
-
SHA256
b41874af68c9d9fc2f03aa9b2c7ebabfca9b28d027b4e51cd854904b686ff151
-
SHA512
d4542c5192d8d91489e12eba50f34a002b57cffd8d09e3ff2b14669e2eb0c6d02d4032c372ae930dee6b1535b9659bdd35f91d23deb52f3b8624a6f2b7576572
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqhMWKajna:6j+1NMOtEvwDpjroba
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-18_55b96169916a544518b917a80e61c7c5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-18_55b96169916a544518b917a80e61c7c5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5f01a8880c481663c8dfd12deb445ffef
SHA1ffbc155b280ab1f6f6397e5d4194f48ebb2b92a9
SHA2567a94da083a7541f42237efcec837df28570ecd50bd12b66741bf8e841e868222
SHA5122acf9cfaa1958a068b10d6cfbbd1ed03c29b540086019766132e718c61c61c64dcdc481c94e8fa3efb8d54a2a46f25433652de7bc15a54163afd0443f0605b5a
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB