Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
25-02-2024 08:38
General
-
Target
2024-02-25_f354b41624c1a2b13ae674d70239f59c_cryptolocker.exe
-
Size
46KB
-
MD5
f354b41624c1a2b13ae674d70239f59c
-
SHA1
8a29612123250757ea1101c6957b98744baf1083
-
SHA256
2320661f2077752acc080deb546d489621e45b5602ba33b32c94d0628ce48d92
-
SHA512
2d4943fe4afbfba1f146c38e29b56a55678ed2c2878ce2135c81ba4f9dfdc42f6c15e47c232a5e477c64723ad31a2d7656abf0f52e8c547176394e0efa85ec74
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvgpnq:6j+1NMOtEvwDpjr8hgpq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-25_f354b41624c1a2b13ae674d70239f59c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-25_f354b41624c1a2b13ae674d70239f59c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
46KB
MD58eb3078d43e862d13b2516c7be0fdb3c
SHA18816b2ac8a714a8d8605d3bb015d8068bbba4e65
SHA256f8ed0749773689f97e9ba55a0b58313e87b8b15107bed5ee0e4c5be5eff8b729
SHA512be85ddf6f940aeace576029ef47fa212883f3054f55b84f434b5a8c3b8f996fc8faa3e2b5765a242fb86789f9b6721a087af9ad7394e4f7844bd6cbbccc62bfb
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB