36e9dca247b363b6c73df351a6eac069a3dbaca5e2c549e7710b462e1bb19754

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-01-2024 12:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-19_24d2650366714789a1d47e4a18b321eb_cryptolocker.exe
Size

38KB
MD5

24d2650366714789a1d47e4a18b321eb
SHA1

dcf40b01d91996a0d5b48062d585c4491824ce21
SHA256

36e9dca247b363b6c73df351a6eac069a3dbaca5e2c549e7710b462e1bb19754
SHA512

09d79b2dceb8bcb20791a9ae9ca320a46473a4331f7afe7f3152f710c3d9d17ceaa1dd75d5630f6570ef299af6a0a71e13fd58f55cf0b13eb3fcc488e010aa02
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunrkwIS:btB9g/WItCSsAGjX7e9N0hunrkK

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002320e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-01-19_24d2650366714789a1d47e4a18b321eb_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
212	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4268 wrote to memory of 212	4268	2024-01-19_24d2650366714789a1d47e4a18b321eb_cryptolocker.exe	89
PID 4268 wrote to memory of 212	4268	2024-01-19_24d2650366714789a1d47e4a18b321eb_cryptolocker.exe	89
PID 4268 wrote to memory of 212	4268	2024-01-19_24d2650366714789a1d47e4a18b321eb_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-19_24d2650366714789a1d47e4a18b321eb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-19_24d2650366714789a1d47e4a18b321eb_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4268
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
38KB

MD5
43a9e5d75f8509409815ab1ed7ef7480

SHA1
be2f4d86a86b5ef83ca39e3c47758be37e21dc79

SHA256
8c4c5a7a913284b83e5653a8fea62a8d45b5506fa47826ae86b81abe24274803

SHA512
98a51d272c09871cd5deb6adacce48fc7cf4163bdfcb6c2cad6fbb4d18ae8b8ec4f363f732079c7f070f77fa1b589af4f9e094a57cc84c668bbc6c36420e08f4

Download Submit
memory/212-25-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/4268-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4268-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4268-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download