Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/05/2024, 17:11

General

  • Target

    20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe

  • Size

    25KB

  • MD5

    aef78f46044d7cd4000c244e07cb0e91

  • SHA1

    6f91ce25fc3a7888d7ca1b78428f760c77f6c5e8

  • SHA256

    67e186e160b03e8b473a6099bbdc15453e697d5b3c2895d01451d3b94b085160

  • SHA512

    a566886eff4edb6dc88dd3571dd1a66759d8b110c9739f1851f04bc08e3613c9120b5e77e796543febc57b3f810d9b21daccf18c4dae97e6ee0b31fce829f37f

  • SSDEEP

    384:bVCPwFRuFn65arz1ZhdaXFXSCVQTLfjDp6HnpObd:bVCPwFRo6CpwXFXSqQXfjAHAp

Score
7/10
upx

Malware Config

Signatures

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\20240517aef78f46044d7cd4000c244e07cb0e91cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\hasfj.exe
      "C:\Users\Admin\AppData\Local\Temp\hasfj.exe"
      2⤵
      • Executes dropped EXE
      PID:3700

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\hasfj.exe

    Filesize

    25KB

    MD5

    081452d0f0ce0ba0b44ddccf0bebf672

    SHA1

    ba7ab082a343d6f7b78cfd85a6593aff4862b7a3

    SHA256

    2a563793673ab1b222440d0e8380e5db0f1c4c2e779c706ccdbc412f431568bc

    SHA512

    3636f0086874a2d06ce7ee26ec2c37aae8d5685ea488a0a7e05a5afddaa7f851e56f10d3f8cb9a193b7e88f42e01201acbb927b0145d4e594f48966e5dc9a183

  • memory/1968-0-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/1968-1-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/1968-2-0x0000000003150000-0x0000000003156000-memory.dmp

    Filesize

    24KB

  • memory/1968-9-0x0000000002210000-0x0000000002216000-memory.dmp

    Filesize

    24KB

  • memory/1968-19-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/3700-16-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB

  • memory/3700-21-0x00000000022C0000-0x00000000022C6000-memory.dmp

    Filesize

    24KB

  • memory/3700-27-0x0000000000770000-0x0000000000776000-memory.dmp

    Filesize

    24KB

  • memory/3700-28-0x0000000008000000-0x000000000800E000-memory.dmp

    Filesize

    56KB