Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
24/04/2024, 10:23
General
-
Target
2024-04-24_1201f9a90f940a2ec3ca2e14522bd049_cryptolocker.exe
-
Size
55KB
-
MD5
1201f9a90f940a2ec3ca2e14522bd049
-
SHA1
e7cb29d678908b3adfdba6acdcfb4cb584f1b3d0
-
SHA256
ad29eb33f51cac0dd459f5c5be2448e6af2b158308d5e79817f971c2630bf1b1
-
SHA512
13f667e5762818ea7d02a50a8142659ed6c847ec0a22f31bd2932c00e1969894e3d2859e50b6e7f40df87762c97ffba4c97deabf609b8c05db6efb6deb3ce6a2
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlj:bP9g/xtCS3Dxx04
Malware Config
Signatures
-
Detection of CryptoLocker Variants 2 IoCs
-
UPX dump on OEP (original entry point) 2 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-24_1201f9a90f940a2ec3ca2e14522bd049_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-24_1201f9a90f940a2ec3ca2e14522bd049_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5cc0cef6f3d7f768845ac5af0a971e3fe
SHA10e2d994c6b6d9c3e94637dde2ac5c1920a82e31c
SHA25639f99958c7b16329f32f84f7613e071bec6eda8c17ae613ddbc4918ec0acc0a5
SHA512cbe3f03ba0866bb26f2cedce2f56fd29cb431fb8a0a8b52c5cb560e5f29e3d25201e370645fab1db73dda29f52d1888e79a5bd9fad6449e3343da8276085ee6d
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB