Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
-
submitted
15-06-2024 23:25
General
-
Target
2024-06-15_bc8375c6b5dbf2ebbbf9ce941962d1eb_cryptolocker.exe
-
Size
57KB
-
MD5
bc8375c6b5dbf2ebbbf9ce941962d1eb
-
SHA1
b668494fa84aeea8a6fd701b8251978d3ef7274b
-
SHA256
ba2eba0cda257c68aa046277140b6d623f4a163194777f6175bc0ce0719c14d7
-
SHA512
2edf38f7b26bb7b31e10f4191056b9ca8d8d0b83871e44dfbb694a1d40d34771bce6027ee10fc1829561a17ca479677a037a66299dc139feb1e25bb5b8a89367
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlYo:bP9g/xtCS3Dxx0Lo
Malware Config
Signatures
-
Detection of CryptoLocker Variants 3 IoCs
-
UPX dump on OEP (original entry point) 3 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 1 IoCs
-
UPX packed file 3 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-15_bc8375c6b5dbf2ebbbf9ce941962d1eb_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-15_bc8375c6b5dbf2ebbbf9ce941962d1eb_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD58fc72486d77429f61580d4daa6d03f85
SHA1728a088619e8a509a78c35cf4b688b7632194ed3
SHA2569e0d973ecb909db371e5ca29af927380291363adfef2840bfffe20bcc6a5c321
SHA5128600dc451b6a6f675549119ead0bdd71319943ad18951c81aeda5b423580d2792fcfa6d0bc9089fa9c78e5b8723355933f90f9eba7da7b5b678bb795b7e4c0a2
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
24KB