Analysis
-
max time kernel
146s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25/02/2024, 05:04
General
-
Target
2024-02-25_abbbf32259def0d925bdcabed0f35481_cryptolocker.exe
-
Size
57KB
-
MD5
abbbf32259def0d925bdcabed0f35481
-
SHA1
87aef46c66a28c83263bcb76243a853a65a5657e
-
SHA256
580145efa2f9a84bc89b3576efeff04ce8105a50dbbc3442292545926f3cc03d
-
SHA512
5d33e87e1bb4b29c01ee5f846956ad04fde4f3681b4922a2782ab45b5c717aabbefd33f7dc53cff1f3afeae1ea817edac114ef7b98570980133dcd7fd341029b
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7GoFr:xj+VGMOtEvwDpjubEgyr
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_abbbf32259def0d925bdcabed0f35481_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_abbbf32259def0d925bdcabed0f35481_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD50b4e40da9ee5c233e9ca66d280be147a
SHA1c57842ee4f940d6039d1321536cbcf81a03fd04f
SHA2565be54283ee42dbb82757067f81841fb3dbd6e4a583ce75c1375f75ce6565493d
SHA512bc008c3da927a3c0a54f3d2b6761cd84f399fba93f7e18f926b2afe2af225566ad6f1b696ba5b5f8c9824b0abb1d9b94065f50560e224e4291f5f29412ea0fe1
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB