efeee5cb6891013d6a29cbf0a0d81a50c16f70d2f1666152b5f7df7c66cab468

Analysis

max time kernel
87s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 07:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe
Size

39KB
MD5

f5a3e44f47e6cfcc80c98cab493e8eae
SHA1

27081f01b1debba10271589e81c8b067f4d9f875
SHA256

efeee5cb6891013d6a29cbf0a0d81a50c16f70d2f1666152b5f7df7c66cab468
SHA512

058ce5ce9013b1b67e9254444895d8539269221c705b1f541ee289b710b866fa96b0aa811e2c4f689ffb7bb532fb67ac6349904d2a09d534861f52853c5a34f3
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunrkwIxZTi:btB9g/WItCSsAGjX7e9N0hunrknm

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f5-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
3420	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2544 wrote to memory of 3420	2544	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe	86
PID 2544 wrote to memory of 3420	2544	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe	86
PID 2544 wrote to memory of 3420	2544	2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_f5a3e44f47e6cfcc80c98cab493e8eae_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2544
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
39KB

MD5
5256b941752e60f7fc2712907a285353

SHA1
ca43fa070821a34bc404fd8b33bd596ed2099a5f

SHA256
e76bb7ab92a84b5e04ac61c10a77ec8fe78f7d46b0fcebe75252cd03f9679e75

SHA512
ca551f1559387e70e46ba3a1c6e8bce81d1cc6f3f4627fbe246dc26077a3940dd54567fed1919a2dac3fb27760728bf21ec9d96fb39d4e8e9cccbb53e1335021

Download Submit
memory/2544-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2544-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2544-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3420-20-0x0000000002000000-0x0000000002006000-memory.dmp

Filesize
24KB

Download