Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 15:42
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe
-
Size
35KB
-
MD5
8d40ba89b33e329fb0ae3e9bbe3b00c3
-
SHA1
61f3cec5cf20adc1d74d76767cd2813c300978ab
-
SHA256
2ebcf4f6960e5e8186c7310d9617a304dd67aa1e7d2fe022e14f81a8bf322889
-
SHA512
621935ca08f7ef95b24e2e005e977e4018a98e3a4b8d8d140789eb5e4f995e5eb3d989ded04e276ce3297681e527a7d5e3338781cb643945cca5e1d167f24944
-
SSDEEP
384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXun19:btB9g/WItCSsAGjX7e9N0hunv
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\gewos.exe CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
Processes:
gewos.exepid process 2320 gewos.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exepid process 2404 2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
Processes:
2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exegewos.exepid process 2404 2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe 2320 gewos.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exedescription pid process target process PID 2404 wrote to memory of 2320 2404 2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe gewos.exe PID 2404 wrote to memory of 2320 2404 2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe gewos.exe PID 2404 wrote to memory of 2320 2404 2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe gewos.exe PID 2404 wrote to memory of 2320 2404 2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe gewos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_8d40ba89b33e329fb0ae3e9bbe3b00c3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2404 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\gewos.exeFilesize
35KB
MD5196f12a243a9d38b806db1d4b91aaab3
SHA129972ec9a9e1f367441f0bd65ff4ceb4f82495be
SHA256821bf1101bb8f3e8ba67137be02a98a4d86460e54363fc650a42db588cebfc5a
SHA512713d32ced02248e56c92deca8f52d69b8e4cf64c039c36c77f768cc5b606466d475d349273154224da0e828f0ffc25307fda2e6806d1276ba640ba7af60eece5
-
memory/2320-23-0x00000000002E0000-0x00000000002E6000-memory.dmpFilesize
24KB
-
memory/2404-0-0x00000000002A0000-0x00000000002A6000-memory.dmpFilesize
24KB
-
memory/2404-1-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2404-8-0x00000000002A0000-0x00000000002A6000-memory.dmpFilesize
24KB