Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
11/06/2024, 08:43
General
-
Target
2024-06-11_dde7dae7bf9fafbbf7b496d38c1df9d2_cryptolocker.exe
-
Size
44KB
-
MD5
dde7dae7bf9fafbbf7b496d38c1df9d2
-
SHA1
ac4ec5140ceecbc367ad6f8c891320a94d12a40d
-
SHA256
7ab756af507529c6849d6421437ed2c35b30d36b8c360ffc478cb2236d272c0c
-
SHA512
86407f32c36122e6c726b2925df7ea31064d4c01787b5eca3b96d8f09f570657a0ec270bb5dff6327c17f615deea69ae8d37269ca64d6b5c2f54ea7d9193a880
-
SSDEEP
768:6Qz7yVEhs9+4OR7tOOtEvwDpjLHqh6/aDf:6j+1NMOtEvwDpjrRM
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 5 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-11_dde7dae7bf9fafbbf7b496d38c1df9d2_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-11_dde7dae7bf9fafbbf7b496d38c1df9d2_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
45KB
MD5086d608724b91ab7ffb1f2b81fbaf148
SHA1a7a4c48cb4c082df0e2e0e99f8bcb60bf4d2bd5c
SHA256eef8d7a4c0245ce0b4355709bde69325c6fe24774cb093a81d235fe012f7327b
SHA5126cfb6dfc711c44165658cdf8842c6cd0091559a94d068bdaf84204adbb1585107c75e18e7eac7c9e5c26be7ed229bd39cfc7f4386a3f339c03df369114121db1
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB
-
Filesize
60KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
60KB