Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
23/02/2024, 06:48
General
-
Target
2024-02-23_85e613403f623a89ce948f66082a9474_cryptolocker.exe
-
Size
46KB
-
MD5
85e613403f623a89ce948f66082a9474
-
SHA1
672d52a2b68c5c9f29a367422481b51f55081557
-
SHA256
76f87c3cb1697a1f772e0234444adaad1ce09a370c3ff2a0c090081a6b668c32
-
SHA512
969dc5a27fc915aa1644827bbf63cedc8956f87fcbc8087b3843a9318bfcdd6c60a7ede9b8364901aca9df2d6899472c1c6f114f1c4827e534931a634eff0c20
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLtldtb:xj+VGMOtEvwDpjk/tb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_85e613403f623a89ce948f66082a9474_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_85e613403f623a89ce948f66082a9474_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD59fcdbeb9688257d80588c8a8e3048fea
SHA1939f55a7f5109cbd2a7f3b43e0a704b7e3078b3c
SHA25646349f095492aec85b01f79df8cebfb47a06c9ae117996cbffbee9b2d215624a
SHA5123b98f5370400e177972364852a3b27e25316f2a0a8c535e73b545f60b26808327e84af12db8e4fdd8d6d4094cc323a1fc4947c5615469931d70b188fef0960b3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB