Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
-
submitted
20-02-2024 12:26
General
-
Target
2024-02-20_1fc4c6cf96a785d7289cb2c4403356f3_cryptolocker.exe
-
Size
105KB
-
MD5
1fc4c6cf96a785d7289cb2c4403356f3
-
SHA1
a55761efe669b7bbc0f6af6da9c9d8697f870c41
-
SHA256
832b16756321b254e6506b57d3438732e331c36f4b082251317d050245a0418d
-
SHA512
69f606a26a5635921bfdc6ec802b2143de1f66909f8d9438eed68b4d71946978d089a65f72ebd7a7e80a02c9c9a222f10a2936894412dee7ecc10b2c3e36c479
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWjy9K:xj+VGMOtEvwDpjubwQEIikuK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-20_1fc4c6cf96a785d7289cb2c4403356f3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-20_1fc4c6cf96a785d7289cb2c4403356f3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
105KB
MD59f433bc88ac35f614fa53524fbe3c598
SHA17d32f43b25f89751ad16a8f6fc346250e6877d23
SHA256cc3016df1156ddc9853bdc7bcadb9588f6fde4a2447808e2b3ef521edb83cdf3
SHA51295eeeee03cbcbdde29fc2e3d8a0804f65d516e7450ee678e545472a588eae89b2f8df554fc8322092cdca5fe409f4ef8b5e9ca82311a1ab9e43b4979fb1f1388
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB