Analysis
-
max time kernel
91s -
max time network
113s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
18/04/2024, 05:45
General
-
Target
2024-04-18_cb4cd07ca7b3fa8da3e4b62d32d84115_cryptolocker.exe
-
Size
54KB
-
MD5
cb4cd07ca7b3fa8da3e4b62d32d84115
-
SHA1
37bef5bdc59858efae5da1a3ac6ba09c6515ebe4
-
SHA256
6c7d288794c102582a324388235a1c908528bbdfc9b0bbad6cbf23b7f36ec6f0
-
SHA512
bea6a0721fbef4f005640efdad37fd3c23cb0d5a0f18c8f7ee23abf4ff89fe2f4c4cb9bdee09af500a891a868a005cb6ec4c45851c2cee1638de9136d36a0c8a
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlo:bP9g/xtCS3Dxx0r
Malware Config
Signatures
-
Detection of CryptoLocker Variants 2 IoCs
-
UPX dump on OEP (original entry point) 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-18_cb4cd07ca7b3fa8da3e4b62d32d84115_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-18_cb4cd07ca7b3fa8da3e4b62d32d84115_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
54KB
MD502245cd1438188c3953c0b91644d0faa
SHA1bfaad705a0a01156d86d01f0d384d9e122fab294
SHA2568c95d3c342350095151b57af66a5f80a97d6ae81863daa28473be3b52bbef7a6
SHA512510667f5615571327cf6141f10d72aa10d5fe8afa296ee71d08d7e5b6409e8935aaf8e50b6bf364f970ff8c4118e6b609970b5700d7a718b6247b8c5634bc6d5
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB