Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 15:50
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe
-
Size
34KB
-
MD5
cae6ddac0700607d6e516b3072098145
-
SHA1
22d8734aefb43b4d7dd3da9c7de15f0bbb8a4a5b
-
SHA256
6bf36f68b6a12cb76ee51ef7685bebc9fcdb5c74bb3f3299ac73f4779a40d716
-
SHA512
35245e9032a7b485d84d111564f9a6b228457042909c34dd9d0be7a508d11144395a6dab75f9d97c9073c6a5e6d00a8821bf27aeec06e920ca3aacc7ba0ec020
-
SSDEEP
384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunAj:btB9g/WItCSsAGjX7e9N0hun8
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\gewos.exe CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
Processes:
gewos.exepid process 2848 gewos.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exepid process 2932 2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
Processes:
2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exegewos.exepid process 2932 2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe 2848 gewos.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exedescription pid process target process PID 2932 wrote to memory of 2848 2932 2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe gewos.exe PID 2932 wrote to memory of 2848 2932 2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe gewos.exe PID 2932 wrote to memory of 2848 2932 2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe gewos.exe PID 2932 wrote to memory of 2848 2932 2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe gewos.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_cae6ddac0700607d6e516b3072098145_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2848
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\gewos.exeFilesize
34KB
MD5f0cffeb889c19834dc33986d43fdcd78
SHA1b8aa148c0a1ea40333a11e817a9082ea1691db61
SHA2563cf196df2bd82394fde9b9392c7b4445d9c25553b6e4a6e128b3fc92354c70d2
SHA5127544054ef6456b89d1974b60cc06c9b556db4fc42603c8dfeaf8dffc821d18b31f89bad1861636067cadd886a9aceb41e630bdfde9410fe6d5c8b9c6d242e12d
-
memory/2848-23-0x0000000000260000-0x0000000000266000-memory.dmpFilesize
24KB
-
memory/2932-0-0x00000000003C0000-0x00000000003C6000-memory.dmpFilesize
24KB
-
memory/2932-1-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2932-7-0x00000000003C0000-0x00000000003C6000-memory.dmpFilesize
24KB