Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/02/2024, 08:10
General
-
Target
2024-02-19_d1aaafdc6ab55133e63d7b5fedade2c5_cryptolocker.exe
-
Size
38KB
-
MD5
d1aaafdc6ab55133e63d7b5fedade2c5
-
SHA1
eaea33bfe34361f34d9c013bb35287b79c54f679
-
SHA256
67ba47682ea5812e82ef8500a9b2f3f7537dd8e38d9b46f6c6b8fe0ecd2bc064
-
SHA512
a3a0048f6c3122592e06b1a3bd681a485ecd84aac3c704ffe217c3647233d75b616b3c0b8212a984547419f0ba26f930dadecba683882b85348a89e745ea54d1
-
SSDEEP
768:XS5nQJ24LR1bytOOtEvwDpj66BLtldJQp3v2:i5nkFGMOtEvwDpjn/JQx2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_d1aaafdc6ab55133e63d7b5fedade2c5_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_d1aaafdc6ab55133e63d7b5fedade2c5_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD52d9abfa1cab9b7bc37afc47cf82fdc87
SHA1a3e66b272614fa3914b249cf0e2a986d819cc626
SHA25661297bf0392b2f487900190a6c8f4033b457c965aa4e3d93e44ff156f4e16f79
SHA512f9e859bcfceef9ac26d815aae39246eea5730d8b8aea08c110a4202b8a0a5056149c32c0832304ce4517918702ee4dcf2566990c8446c9617c5efcfb9f4b4045
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB