Analysis
-
max time kernel
147s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19-04-2024 03:51
General
-
Target
2024-04-19_5722ff1635c6ba393144a75f339563a7_cryptolocker.exe
-
Size
48KB
-
MD5
5722ff1635c6ba393144a75f339563a7
-
SHA1
e811ca734a95df23541eecde07b449f89e2c68cb
-
SHA256
15fbe4b4dca2034ce97d1d1c603cd2a0fdb47969e11e415a08ce847278b95154
-
SHA512
23cf3cd520c6583c96578db57f938aaab41f6d27d9a53744a330c6a0e7428e62f42225ca99e7fe725929bc2e6f340b665cd2e8d25f426d527efa556e40659cce
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWE6BLbjG9RzhwaN4NOti:xj+VGMOtEvwDpjy+TN4+i
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_5722ff1635c6ba393144a75f339563a7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_5722ff1635c6ba393144a75f339563a7_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
48KB
MD5880d2bdec705617e5e68f6be088baf09
SHA172cca43ab2a83c3a1d64e014148853c4846a4b0a
SHA256fa9e0a25383684653a74997c4f5c8e309a70677298f62bfb4ecc75e70d208d51
SHA51268d0d8941cc8cdb2229b546130664c97ad82f06afe44dfbf5e52c48380794b8ac90e8fb2ee14784d05da0608f1bb3c0f19d696ae28fd35150994eb3019b1cbd3
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB