Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
21-02-2024 18:05
General
-
Target
2024-02-21_f50d1b235c48a9b4bd0d33c8665223df_cryptolocker.exe
-
Size
38KB
-
MD5
f50d1b235c48a9b4bd0d33c8665223df
-
SHA1
10c86958c90ada6b2a607a9a3c3abc2805a7372b
-
SHA256
c64be6b3d8c005494a4bc6953402c854913ab2a16c761f9cfc0f25cf0a85c8fb
-
SHA512
3466c4242d3566da4ff65eca8326aaf2c6a991aa1a30f51631c9bfced9080b60d3ffb080e00df4194af551e9a0651db59d3ac7df63ff994e1c0b9b6294489503
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRhpky:m5nkFNMOtEvwDpjG8hhXLpky
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_f50d1b235c48a9b4bd0d33c8665223df_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_f50d1b235c48a9b4bd0d33c8665223df_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
39KB
MD505b0c1e75b1adf6535ba992d8d507512
SHA1869615921c0ec3cf7b760f5e1566424085d82428
SHA256c604e158e1c76546c38e87a5d402164faa65d9e421efbada5d90b94e5e472936
SHA51204bcd8df9575637abe9db4f7a369c5cacb379b146d32bdcaf245f061bcbcd043af19e3643d07fedd16af10b2a543d29f6e7d5ee2d071f3bbe0496f666e8f1b99
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB