efeee5cb6891013d6a29cbf0a0d81a50c16f70d2f1666152b5f7df7c66cab468

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
25/01/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe
Size

39KB
MD5

f5a3e44f47e6cfcc80c98cab493e8eae
SHA1

27081f01b1debba10271589e81c8b067f4d9f875
SHA256

efeee5cb6891013d6a29cbf0a0d81a50c16f70d2f1666152b5f7df7c66cab468
SHA512

058ce5ce9013b1b67e9254444895d8539269221c705b1f541ee289b710b866fa96b0aa811e2c4f689ffb7bb532fb67ac6349904d2a09d534861f52853c5a34f3
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunrkwIxZTi:btB9g/WItCSsAGjX7e9N0hunrknm

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012251-22.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1948	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
1572	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1572	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe
1948	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 1948	1572	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe	19
PID 1572 wrote to memory of 1948	1572	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe	19
PID 1572 wrote to memory of 1948	1572	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe	19
PID 1572 wrote to memory of 1948	1572	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe	19

C:\Users\Admin\AppData\Local\Temp\2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
39KB

MD5
5256b941752e60f7fc2712907a285353

SHA1
ca43fa070821a34bc404fd8b33bd596ed2099a5f

SHA256
e76bb7ab92a84b5e04ac61c10a77ec8fe78f7d46b0fcebe75252cd03f9679e75

SHA512
ca551f1559387e70e46ba3a1c6e8bce81d1cc6f3f4627fbe246dc26077a3940dd54567fed1919a2dac3fb27760728bf21ec9d96fb39d4e8e9cccbb53e1335021

Download Submit
memory/1572-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1572-8-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1572-0-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1948-23-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download