Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
21-02-2024 19:40
General
-
Target
2024-02-21_65d88a380e80164c46a7bf223471630a_cryptolocker.exe
-
Size
47KB
-
MD5
65d88a380e80164c46a7bf223471630a
-
SHA1
1b0f47d458a847b64296883c6e62f8f249fc1a25
-
SHA256
cdea96c50652da3975b7518a7062b4a682efc311f4026ac43064256652217148
-
SHA512
4086839adfa6e1a7b965c4f5385a94ba0a6a346f461f2265b613a4223ab9407645599cadb19e822e1d6a0d82ad29095dbd7d23521727d81a08e613356d96742b
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLtldJQBY:xj+VGMOtEvwDpjk/JQK
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-21_65d88a380e80164c46a7bf223471630a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-21_65d88a380e80164c46a7bf223471630a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD5da533738509525dd09dc41722a2b3a93
SHA15f3a9b71314aeac65bd8979e22057f23afa11a0e
SHA25679f583c89db6997bee3d0286b1cd5f23e7140506471c0703de1cd9eb59f22981
SHA512679442b945ab596c79c22807d94f52135c0439bb7b71f90203057fe363445b723fd54942da51555de43c12bfa74ecbc2b80599eca0e1c5f07d4f6804662a2ffb
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
64KB