Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
20-02-2024 06:11
General
-
Target
2024-02-20_d05fe3dcb148a732b38267c309e418fc_cryptolocker.exe
-
Size
39KB
-
MD5
d05fe3dcb148a732b38267c309e418fc
-
SHA1
2cbbc7e780b5320407462f380a266502a27418f8
-
SHA256
755b3771e0df80b3cfcfaf5ead599384285c5e1b37ec67fad138de3b1592b9df
-
SHA512
820a6a5c475392173073faacfb72e90c7c20851ef9429dc0f8c343b7f8acce9395b050168a2ebc915849a89dc0d0a5c268987a99e34689442327a58598455a45
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRY+V:m5nkFNMOtEvwDpjG8hhXy+V
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_d05fe3dcb148a732b38267c309e418fc_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_d05fe3dcb148a732b38267c309e418fc_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD506160b4537944a5c5b1e67290db6cc5c
SHA1695a18328490632a4ccc0c3b763840775cdfd2b4
SHA2566bf2499677cb92a873c4341b5e986193fdaf53d06e944108f2488294f5296b1c
SHA5125f77e19b2b0917b3235e282ea3987740b1717dbef687e4156f010f1f40a2316c9876e64ae9a3683e1186e596bbd62ba2a161ff737f17ab3ffb76e8392915a6b8
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB