Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
22/04/2024, 10:41
General
-
Target
2024-04-22_6345806c56a589bd4abf956c6996f99e_cryptolocker.exe
-
Size
41KB
-
MD5
6345806c56a589bd4abf956c6996f99e
-
SHA1
f2f7f9c6ff2f377cec0048bd574c53134619c69e
-
SHA256
6a3d7d3936614fc34241504fef36f73a17565de0a0df6ec5638d5e43ce39cd6e
-
SHA512
3c4f67eb2de8d945d534aee39e3bee9a9b7291c91f8ea8b1fe39cce9f80b69b59f5c0df4260eb216b0d4da2f0a4f8b7d0000bb9c31bf36255ff3deb76d4c8e3f
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/at:6j+1NMOtEvwDpjrRm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-22_6345806c56a589bd4abf956c6996f99e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-22_6345806c56a589bd4abf956c6996f99e_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42KB
MD5826d76dc217405144a69b04465d40a26
SHA174b0eb55c92f80d864b050302469874ab0de76a4
SHA2565e4d232ca2ae28c47667d0e42cd636305795622eda00980387f9efb0c8252432
SHA5123a65c9bde8db01c4be40bd108997d99caa1e65e9d4bf80c30738fd050fb38b3bfcd0503f2cf606442d71111a542cd3b1e97bda84c73f0c2a3567c7cb12b3a491
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB