Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
19-02-2024 08:22
General
-
Target
2024-02-19_00fe59029a0eaa9bcac5a3e0f03eb2d3_cryptolocker.exe
-
Size
53KB
-
MD5
00fe59029a0eaa9bcac5a3e0f03eb2d3
-
SHA1
faa7497d325ff922b6e75cb01d275dbf6f0a141d
-
SHA256
8e25ec1b4dd3c1fb440f6535de1d794a2abc3f0c327f540be6211b168ce429a1
-
SHA512
9d515fdb5198400556b3e0bab126f54b4672ee1ffa879a7dc9d397f6c1a1dae0efe4e07fd2e739daa1ded1ff729101f3be7c774dc213e453570514e6b231ef1f
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz752:6j+1NMOtEvwDpjr8oxEn2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_00fe59029a0eaa9bcac5a3e0f03eb2d3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_00fe59029a0eaa9bcac5a3e0f03eb2d3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5a4f78ce460173ae03cac552cce398dfd
SHA15aabd381a4595f1035979e5cd1587f04c43afa20
SHA2563be7d5df90fad8b8aa5c69cd5c5236ca87aecc1f0065eebaf1b6f27377d781e4
SHA51220dedafed180aec569b554725fc123c65d0082a96a5a52c0a8c6311041c1340f842730371b221822c2d2c4fe94a1e77e0d6cc4f41fa12e963baef854ee9d3352
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB