Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19-02-2024 07:41
General
-
Target
2024-02-19_4f0670a305109f902b0f87808e5ad698_cryptolocker.exe
-
Size
40KB
-
MD5
4f0670a305109f902b0f87808e5ad698
-
SHA1
ede948facb88d6c265a7f6ba88e1c518046fe64d
-
SHA256
1c733c814a7eab3aab3d9680c925e1ca9ae119d52ad9db97cee6ea56f7200b78
-
SHA512
fb8ef1b80c071bb2ab0a83594e90d1fff7728bbce6e29697059972a6214e07b62356da840c2614d8ec04b209ec01be67f1441e28ea72515f94ccc216fe05fd94
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRY+b:m5nkFNMOtEvwDpjG8hhXy+b
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_4f0670a305109f902b0f87808e5ad698_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_4f0670a305109f902b0f87808e5ad698_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5dadabe2f126baf052e2f620c9ca3d828
SHA12996880e4f3393667c122d5c7519a222fd3fd7b9
SHA256c91e6df9763a7f7ea0b54aadb6f00f9230f0c885ca26d3cde248d6ec8f2565ae
SHA512cf44a3d9e328962f22ff9ef4269f3be039be37fd852f162d3ebfb9d52e6d1dd64cdda3819901263680ca391c01f0a50ef417db253ffba9b72783ce9bb1162336
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB