Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
20-04-2024 16:24
General
-
Target
2024-04-20_05eb49bb08850b5eec0779d8a9a7dc98_cryptolocker.exe
-
Size
61KB
-
MD5
05eb49bb08850b5eec0779d8a9a7dc98
-
SHA1
a8c9582adb5e8a67178577c4f00095204a52f9ff
-
SHA256
b880299e36570cb108135ad5f5096e07cf34154e6e2a12425ecd3d1aef04b770
-
SHA512
b47840bb763f3613f59f0d67e51f1329e9de6cc69b02186adfa5808b19da4818d18a0aa052840e069072fa9e17890116111905abfc56b260c6cd204bf310b96e
-
SSDEEP
768:xQz7yVEhs9+4uR1bytOOtEvwDpjWfbZgBh8i6g7GoFwDFOJ:xj+VGMOtEvwDpjubEgyws
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-20_05eb49bb08850b5eec0779d8a9a7dc98_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-20_05eb49bb08850b5eec0779d8a9a7dc98_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD510c23003f4bd977ca6fb0d2466032a04
SHA15a29566d6b5ab490a578d12a0f2865a927289933
SHA256b53464583e4ea90029c3ecb5f63f869433c8c193b33547be44d4633070c0eeea
SHA5120a1d428c5d912f3c08109d5c306d6f9300442e5c9964ff0416aa437344566d78b8c1ac53b342d9f396f69bdafe5a6cf99f5bec0287a7b25e037cc281110862f5
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
64KB