Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
12/06/2024, 23:34
General
-
Target
2024-06-12_a316e34b0260dfea18cd39df973f62a4_cryptolocker.exe
-
Size
43KB
-
MD5
a316e34b0260dfea18cd39df973f62a4
-
SHA1
5c5be089b7851b0822e63c1262887dba69ef0c04
-
SHA256
25235d6cbd0c2f54c1295fa53c76dc5e44c4bb87bc1c1d03cbcf8baa28892e58
-
SHA512
be37cdda03774f808455a9393f769df613fd5d70d69f77ac2d8df61a31bb84a3f1b66854b7fbf167d9b4a11a01678239739588aacaaf9e3ca82e4a2538ffca6a
-
SSDEEP
768:TS5nQJ24LR7tOOtEvwDpjGqPhqlcnvgpnY1n9X:m5nkFNMOtEvwDpjG8hgpY19X
Malware Config
Signatures
-
Detection of CryptoLocker Variants 5 IoCs
-
Detection of Cryptolocker Samples 3 IoCs
-
Detects executables built or packed with MPress PE compressor 5 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-12_a316e34b0260dfea18cd39df973f62a4_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-12_a316e34b0260dfea18cd39df973f62a4_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\misid.exe"C:\Users\Admin\AppData\Local\Temp\misid.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
43KB
MD53b5bc6b4cee359d374767425b263f9c5
SHA1ea534bf2b5d02d5c9d5b3e61a093dc1236170be8
SHA25641a3e1c7957c8c2da4fd3fb75de93bfa6064955e27c1a9ab72fcd22ba9fa4f56
SHA512ca6e221173aea9f89989e1ccecb242ada57aff12a07b2d0e614ea500e00e8491636c1cce24722ad05bd751aa688683cfcc0e7d5358a6b7a1daeee4dfbb6fd849
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB