Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
-
submitted
26/04/2024, 04:38
General
-
Target
2024-04-26_49f5cf5341246e8ab26fcd6a1bd3908f_cryptolocker.exe
-
Size
55KB
-
MD5
49f5cf5341246e8ab26fcd6a1bd3908f
-
SHA1
a1111a78b016d85893cb3a2b4e8dec55189711f1
-
SHA256
5dc85d6c9c8b9cac9b9139369c7270f921097281ef85d6b14e9f3f1d0b6b04ad
-
SHA512
82699b5dbe5ba7e415ebbec19363e176a3b95a852173ac6bdc5d7e7c9ea4199215e1f5984334b1024f7a01485f3496be9a3f409543dd75b1151c5a2fec7cedbd
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjNcm:bP9g/xtCS3Dxx0lm
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
UPX dump on OEP (original entry point) 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_49f5cf5341246e8ab26fcd6a1bd3908f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_49f5cf5341246e8ab26fcd6a1bd3908f_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD52901c04e700bb3fa3589d7fbfa98d717
SHA183d60bf1ed20221f64ded37f8eb992f488842531
SHA2564659befda58b6bb63f04049466c68958bf9a2b91d2ebd3d83fe058d2820226d5
SHA51201b44f9e029020194d9240e4cde0b8200c4aff8b88b0f43d14912a16ee6a70455e41f4c189a6e61065e95ffbfcb82186ad225adcc9c59327ba13f94213fdb410
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB