Analysis
-
max time kernel
148s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22-02-2024 05:40
General
-
Target
2024-02-22_f70a8898e2b964066cd6e6f66fa25086_cryptolocker.exe
-
Size
40KB
-
MD5
f70a8898e2b964066cd6e6f66fa25086
-
SHA1
07c0b52806c3329e0f75c3c96099bd98485092c9
-
SHA256
b82caf6bfb220d83a96cd5a430d2f0d7c7e1f0a46a06d8c8e6c5d710db5a489f
-
SHA512
e6147ceff1de7ecd54636f991f7142bb1b85ac409a354eb566ca2d91a73a1cd3f57aea60f1e0bda0ca149a4a305b7849de9bf36ad224d5500bdd1a601f28a3db
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRna:m5nkFNMOtEvwDpjG8hhXc
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_f70a8898e2b964066cd6e6f66fa25086_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_f70a8898e2b964066cd6e6f66fa25086_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD529a8341830ddaf745ee83a13ee6ccdc2
SHA1d0e408b1698e11519cdb9883d699002e5d1b0622
SHA256312b35b789bc5b3fcc8ec7f170ec7e9c6300fde8de942659f8625ba19ca8a70f
SHA51292a13c10fee4f43a3b1b00359abedcab26845d1b0d032c0f5afd2ad20242c864eb2ea895398756082c37d0dde8f9d6d617d8f5f542757ecf1f806f67094ca30d
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB