Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22/02/2024, 02:37
General
-
Target
2024-02-22_9fe146130d1fadbbc50dc1e2d91a4601_cryptolocker.exe
-
Size
40KB
-
MD5
9fe146130d1fadbbc50dc1e2d91a4601
-
SHA1
e03dfe200aa6978c338715448422912b44869dc0
-
SHA256
b2d6ab297a29a2ad1925aad3b499014699f5049dcbab2295c7744e0ab73e8d3d
-
SHA512
f7b3ba7cd9dd285d89bc9d70cca5add371111d5668a2add32e3bbf3b20eeace552dc6e7f0da6c8db150363d779df4a633b6000b82f3db66384fc6c344aad22d0
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/CyYo7/:6j+1NMOtEvwDpjrRD7/
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_9fe146130d1fadbbc50dc1e2d91a4601_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_9fe146130d1fadbbc50dc1e2d91a4601_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5e524b0bd5751f886efa4c588a893b353
SHA1fc9a122d9b6d2bd55b70a1504f0e109893717609
SHA2568d1dfe80667628ef1acf2afda44feac65228c5584dea2331db5e698a3abccaf3
SHA512798856c676eb987358c97f28c8da835e2eb97fa6ca149e56a713d27a712d397cd53d7199a11621a14a34dae3ce26c00849ab9d0f1bf681c6114dbe6c30cae318
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB