Analysis
-
max time kernel
146s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
19/04/2024, 04:43
General
-
Target
2024-04-19_bd9b70c1c426dfd3a7498b0b868b00c0_cryptolocker.exe
-
Size
51KB
-
MD5
bd9b70c1c426dfd3a7498b0b868b00c0
-
SHA1
714d02d830a55932ec136fb8ee964f36c3f5cb85
-
SHA256
e6c31abcc363ef1380132aea00cdf1b91c00edde30e18cf11ea6cb8781e69045
-
SHA512
d617fc6132a90bca7e0ad9591245834dc7d927c282f3d849fe11065e37d585fd1a086fca9df32f16894e7a855c70c5202e317ac68136b12b26c3a51731f19e62
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRkHg:6j+1NMOtEvwDpjr8hhXiA
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-19_bd9b70c1c426dfd3a7498b0b868b00c0_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-19_bd9b70c1c426dfd3a7498b0b868b00c0_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
51KB
MD5ad25b139a5b04b8efb7389040af9e0dd
SHA1a53c61d5881245b9411a0519e7ce916fd6634371
SHA2564d33293ea80c5fa8713b5f4bb7bec866f059f35af34d9624f4347bb216a6f72e
SHA5129641a4b10c47ab56f56d423a8675a6b56d88e9621f450997a4737cf5bc2adcfbdac415be3ed4be5e635b9c0e410990e2edc34b2f370fd7867edf5e671d229b9c
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB