Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
24/02/2024, 04:50
General
-
Target
2024-02-24_4edb7549f3946013c17ce967e42bb03a_cryptolocker.exe
-
Size
40KB
-
MD5
4edb7549f3946013c17ce967e42bb03a
-
SHA1
df8e656c25ef60fed6d4514cf6dd6062b2538416
-
SHA256
56ee20031a35c184d03147876fa5d0a2f7654c4602caa04ce8c625045dc77e33
-
SHA512
2bd8354a8270ff9a7e4e3134619adf95f05804b9ce393e2f5662cbe1eb0016a92d4e074010289ac248717a8b7a725847c0bac9fffe9b5117ea750d72706c8c7f
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvhx5/xFRz:m5nkFNMOtEvwDpjG8hhXR
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 2 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-24_4edb7549f3946013c17ce967e42bb03a_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-24_4edb7549f3946013c17ce967e42bb03a_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
40KB
MD5efbb03db07b0f2bd483fabd5aa0930ef
SHA16120719538dd5df0873624091574d7d9d635e14a
SHA2563e100696e66cc39d67cf3446a7e43932a5c9e3ec8dac540b1c718a9c58537516
SHA512bcc0722d47d5e40c75685241dcc364d3fdd0417b16e2f2edbfbf261ae25ee0d225eb4ae7956812ceddd2049d2b67a53fb6498b43b11a3f0ece8781a852200946
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB