Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27/04/2024, 08:29
General
-
Target
2024-04-27_b1457d7238c3cfe5b00c619e5015041c_cryptolocker.exe
-
Size
55KB
-
MD5
b1457d7238c3cfe5b00c619e5015041c
-
SHA1
edf346614e2fe9c75f1479daa4f534076bd182a2
-
SHA256
60260c6b24e4c4ac319bc8f5c3de102cebcc3e3e56a1953e2dee64c6f090b96e
-
SHA512
adca4a8906161a9760d32eea408a284933c5dd5454e95831fe1054336b1dbe10ee35e01737d2e5a7d72e5e1813369abdbc00bdf165275bdef1a4b4400ebe123a
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqPOYRmNxt5QJz7/es:6j+1NMOtEvwDpjr8oxExes
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
Detection of Cryptolocker Samples 4 IoCs
-
Detects executables built or packed with MPress PE compressor 4 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_b1457d7238c3cfe5b00c619e5015041c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_b1457d7238c3cfe5b00c619e5015041c_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD54437143c0a64cf3ddb1c849b9e655ea9
SHA1d53dc60bb48bc4f42d1f575c07c0ae3a3c3b4019
SHA25636b0b1d75d9e2aff6fe6d60291de1bc3cf34c68fcc45afa367bdb0a2a10747b6
SHA51295bffb4692439e05dd1e3e051e5393f9fef14edafed89366a0ca6a4a118aedbd00ae5f431f5b92632dae2c5b48c95cca9d7153acdca12ff2cea847348bb02d6b
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB