Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
19/02/2024, 07:54
General
-
Target
2024-02-19_8df81645ba00813988a9604272080919_cryptolocker.exe
-
Size
63KB
-
MD5
8df81645ba00813988a9604272080919
-
SHA1
ee8be975a577aba5e45e8b983778a774c44496b7
-
SHA256
3ffe6e3c29b6cec7bffc4b8ab3f4fa386c2cc105b26bf941cf85a99b9f052d57
-
SHA512
0defbde28926fa7dcef88546e75b0d8dc241fddfdad69cad552dfd403ecb559919d958b7941e90bb30ee0ebb0d5d7eaa3d60166aa249f4e493a546006cb17504
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5I52kGEO10H0:6j+1NMOtEvwDpjr8ox8UDEy0U
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-19_8df81645ba00813988a9604272080919_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-19_8df81645ba00813988a9604272080919_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD51d04fe057db0eac5de56e25b1159d538
SHA16a030eb697c5084aabd915b130fdf9a9a9f5225d
SHA2566fb7e21cd8f8466359fef4b0ec1b059c08c40990e4a97478395caf3a52b6b26f
SHA51211f01744cc899df3442aa9c53d96c26036063351e8b552710c79384a718ebe12161edb9238dd239fa11d2936d8e6f5dbcebecb924e3ed15d5e25a833bbd59679
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB