Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240419-en -
resource tags
-
submitted
27/04/2024, 18:27
General
-
Target
2024-04-27_20e137bfa7f5f962cf86133c8e201e1b_cryptolocker.exe
-
Size
54KB
-
MD5
20e137bfa7f5f962cf86133c8e201e1b
-
SHA1
ab83c67f504534b1f636ce2abef322dabbdaf8d6
-
SHA256
40d449d81a96779156097235e5ea4c63265ccf076e6f7300017cd864e15dcc82
-
SHA512
ca244eee089b8cb6077cf24cada6ff3f28910219b03f7c5d5dcda581f27ccec390994f096d5bbdf2df8c9095d74734ddd3e7f09561190faf1bddd0156d4e1522
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgCb:bP9g/xtCS3Dxx0Qb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
UPX dump on OEP (original entry point) 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_20e137bfa7f5f962cf86133c8e201e1b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_20e137bfa7f5f962cf86133c8e201e1b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD5ab49fd648eceb287968a1fd08e46ebef
SHA108d488b3ece32e51db0da1c810951f17a8118d1c
SHA2565251a15bb805c593f5839b5d0d803e1a4060671104a71ca7f506f79f90e35e69
SHA5128742d2fb1755ade515a325231b9933ee372c59fca601fd7e163079da2c04e0c3b8a44968635be93d05b74f51d03b8a8b90955143a9717b2f5557166dc9169fed
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB