Analysis
-
max time kernel
155s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22/02/2024, 13:44
General
-
Target
2024-02-22_541aaf772acfd985b468de95bb6afe35_cryptolocker.exe
-
Size
58KB
-
MD5
541aaf772acfd985b468de95bb6afe35
-
SHA1
0d5204c4afcf0f55e923a4163173f299ee556550
-
SHA256
09ff3e8c7fe28a1d11c150f0b192bb745a3272f1cf68699886de939fd0edf17a
-
SHA512
c120dc320c74cadb2854c2e840bd10be11736466419d07337e3602edab518c7fb22a1db68645d777593302fd559e2bffa290816d69d75911021fe9fb7c0fabdf
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7GoFwEpf:xj+VGMOtEvwDpjubEgywEpf
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_541aaf772acfd985b468de95bb6afe35_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_541aaf772acfd985b468de95bb6afe35_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5e4c4c6ad5f89ec90f4ac001fc8063aa2
SHA1024db270761ea62ca8c8122fd02d549efa440358
SHA2560443cef4e345348a9a5671becad84439289cbcea3def9a434708e319feaf4d17
SHA5123fbddab65557cd2373cc1df6b3daf5cbfdc8befd35d74d9d8ff6f22b13738a1bb6eb0d4467ce7283b4db076d435efca4a19544c49bba0eaa84445f11b9ef362a
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB