Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
23/02/2024, 20:05
General
-
Target
2024-02-23_cf17aaaf33ee6e45e0b9a16bd8e753d3_cryptolocker.exe
-
Size
46KB
-
MD5
cf17aaaf33ee6e45e0b9a16bd8e753d3
-
SHA1
3ca5f335d3e89703294874c7f066d34857988646
-
SHA256
63305d803d37417f2c31d8aeddf43883bbe4f9ceab1b6f6f9e693682208c8065
-
SHA512
4f03c16c87b8f5791e39482a7c1f580965fd51be0d614cfa3ca8f949ed9608b107098ab9b71dcb3061bca9f9b5173de36dbd4a0c5c93ef260945835d20de210a
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLtldtS:xj+VGMOtEvwDpjk/tS
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-23_cf17aaaf33ee6e45e0b9a16bd8e753d3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-23_cf17aaaf33ee6e45e0b9a16bd8e753d3_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
47KB
MD564c62c3dcd1cb3e7bf54c2f6290a6e96
SHA1527c4fef09dbf5f13d3ffc2a53e1b2b49fec60e4
SHA25634fcbd84a1c5c8791b2e00676eed6c774e1e827383f1bc4a27d361a9f2d69107
SHA512e3112f2fa12c197d924204ef10ca01b198c07c962aacf803ddf70d3395d43c9a967715eadd1a6ec36c3017620bc62dcc316207ab2fa79ac7b1d8a6f4139e57bf
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB