Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18/04/2024, 23:26
General
-
Target
2024-04-18_6bd048647005794ac9482e38f96811ec_cryptolocker.exe
-
Size
55KB
-
MD5
6bd048647005794ac9482e38f96811ec
-
SHA1
02476a44237433507047be0129ae12b700ccf5aa
-
SHA256
e9cd92aea1161a35ed1e711bdd51ac30c2e386a9de37ebb5d1de8b75ac294057
-
SHA512
94ebc90cce722e630bdf88d1c752ab79e6839bebba6d1e86f86298d162f5644d49568cd49e72b61f74b74a887b6e1e70ff2ec9ac2abd443b75bde00f93969d6a
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/ee:6j+1NMOtEvwDpjr8oxExee
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_6bd048647005794ac9482e38f96811ec_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_6bd048647005794ac9482e38f96811ec_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5687585ded55a06a37da22d4c17e61f9d
SHA18d5dfde0d2fa0d1d9a6b2f11dde66c3dcd1c6f92
SHA2563be007db8e8331df9ec40a6139b53dc72079215eebdcae669de2e52505f0cbe0
SHA5127649997385cf7aa0b27aa5844b08ae70d80e31a79a2dacb9284071d1ea5f65cf450c7b1b908dfdbe8ddf5d525f7f333996d97bd37362f5e8ec7224a36ad47809
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB