Analysis
-
max time kernel
149s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
22/02/2024, 13:59
General
-
Target
2024-02-22_83170d11e768ae4b5cb6eacaedf83fb8_cryptolocker.exe
-
Size
37KB
-
MD5
83170d11e768ae4b5cb6eacaedf83fb8
-
SHA1
c9fbc1e2bf70ec7dcdc2867f4800c8e9861ca8dd
-
SHA256
bce4a4876adc95bd4349284aa5f0c71af8280ecaeb43c407816538fff3ec535a
-
SHA512
ee7aa4df09baa7d8fb94092e4b31ac2e2b9711117c1a78cdbe609965837ab77b91be85fac6feef0d964c08df170d64fa38ae0b5265ddb9d6476789e36e021a93
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnv0vRt5OHW:m5nkFNMOtEvwDpjG8h0Jt5OHW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-22_83170d11e768ae4b5cb6eacaedf83fb8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-22_83170d11e768ae4b5cb6eacaedf83fb8_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5cc13d0648766111e87cc690c40492bf2
SHA1184afa5b586a04f0d69f5fcaf11bfd21cbfa2f91
SHA25637caaab971e55ffcf042f6e5ea0e60bdc49c7fbcc2f7a9bd6e5052283f446d0f
SHA512b64c3b9eb6869357adb3cdab79e7dd3b0cd3878cc40762a9d5f376bcd0d12e82288e11d73ddd66f9d254c83b931cecb309e6f6cb801bc424147a8b43016b39cc
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB