Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
17/04/2024, 04:17
General
-
Target
2024-04-17_e196fa92906ca04953b4ca12fde64931_cryptolocker.exe
-
Size
102KB
-
MD5
e196fa92906ca04953b4ca12fde64931
-
SHA1
ebc88f841b8e01ecd61c76f23ee1192473d17799
-
SHA256
5db821c534f4665932059e6aa705fe540cbe625f09881027b20d66fdf6bd6e52
-
SHA512
42ee8dd73a501eb50dd3d62d7cec0f35fba5c286a595fafb0bcf0e2a93b654c725f6f6084ba7dc33d4e86a017c8a7b777c73a1e4639b8a9ee71827c4667ca3e4
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZ7uyA36S7MpxRiWNa9mktJHlv/k2yO3xQ:xj+VGMOtEvwDpjubwQEIiVmkxv/u1
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-17_e196fa92906ca04953b4ca12fde64931_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-17_e196fa92906ca04953b4ca12fde64931_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD52016ea1d4a3344ba463e384f9de6f3ae
SHA1e1c657f9d644806c86d315294d7c3d519564d9f5
SHA2564718ec905e019807ce9ee3be265d9103bfe29befce02b79cb0cfbb4b812416d8
SHA5121d8507ce49bd63bb5ae7356f6cd68ccf02e9498cb373f5bdff5a8232160a613057fe81ee140904657cb5d0823faac083540c30dc4af69868c0b0f95a71e32ec3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB