Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
15-04-2024 06:46
General
-
Target
2024-04-15_f2f9661acd9cc99d21fdd06243915100_cryptolocker.exe
-
Size
48KB
-
MD5
f2f9661acd9cc99d21fdd06243915100
-
SHA1
2f66b17e35072fab63f8ea3b087570f47c4b3039
-
SHA256
fa864149526596a1fcf6e346a48095a33e5f229112461609ef9c1f34cd5ed139
-
SHA512
8bf07d842855f0c7f66e59a4fb516cdb8a7a1b268685d4e6da1da7b4ff9bc06af4a4543f747e39b37fca50820f93f60896c91ec03b110a631523b6a2baf9711d
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaN4NOX:xj+VGMOtEvwDpjy+TN4w
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-15_f2f9661acd9cc99d21fdd06243915100_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-15_f2f9661acd9cc99d21fdd06243915100_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD570012bf7362480383b68c74855ceab6f
SHA1bcf66fecc9605b2af6de96944af0af11e712d30f
SHA256525191b5c7ac76fb4c1cd8494ae563186ce9678f9de1b7f294b49d841527954c
SHA51289a1dbb27f530ebf755c3ca220a90149930b9e86dc7d44982cc236270368397c5a59b8a2ea99584f63a6a7d375736e7cdbbce6c018c3b5488b8d5e90b0205c44
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB