Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20/04/2024, 11:28
General
-
Target
2024-04-20_a267cbb625d8cfed9e13a2d59598b962_cryptolocker.exe
-
Size
50KB
-
MD5
a267cbb625d8cfed9e13a2d59598b962
-
SHA1
d2cef5b38751e57a707599172e58d36503b86c47
-
SHA256
ccfcd250a04869415c79dc55c821484fc96820312d5a607364e0e900b5b70df2
-
SHA512
2bd49c369bddbdd46df32d91f9affaf1630500ae0d5e59996df7c1769003d28aeb86c81e3c68589c48addbcbc95e1361abbe812bd26bb85bedf0b6a13c32ee97
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPhqlcnvhx5/xFRHnzc:6j+1NMOtEvwDpjr8hhX9o
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_a267cbb625d8cfed9e13a2d59598b962_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_a267cbb625d8cfed9e13a2d59598b962_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
50KB
MD50b7a1ac5b87268a74b8888144c522b9f
SHA19169696ea2b547f2544bcf69300c57ddb6659838
SHA256e3d980870897cf5de2278641038ff7fbda41c704a49b14db319ac1a65511395d
SHA5128b079f95322babf33bb018a492b612647dd7f28a26d07f2fdde1e6072e172f6755b2ec58884e34cc29b0b15c1b7ac0cfcb61f7a2c624e02bf1a126cfe6bf5bfb
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB