c296050fd43a0c1f9478f3fd9a0bc17fb84ee0337575da7e186b4ff137b1451d

Analysis

max time kernel
89s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03-02-2024 03:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-03_5ba65eec431cd353dc06f21197f69453_cryptolocker.exe
Size

44KB
MD5

5ba65eec431cd353dc06f21197f69453
SHA1

ad052c1c01a8d93e6f0bd64beaa4d01bbf847603
SHA256

c296050fd43a0c1f9478f3fd9a0bc17fb84ee0337575da7e186b4ff137b1451d
SHA512

4aab620338aa2e50c45455721365c53b780a307a0b5721391f12da5abae0efd2c843f95eb76bfd5d866074e43231797d6fee0569766acafe4e1936e3e7782520
SSDEEP

768:btB9g/WItCSsAGjX7r3BPOMHoc/QQJP5YQ:btB9g/xtCSKfxLIc/wQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023218-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-02-03_5ba65eec431cd353dc06f21197f69453_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
184	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3536 wrote to memory of 184	3536	2024-02-03_5ba65eec431cd353dc06f21197f69453_cryptolocker.exe	88
PID 3536 wrote to memory of 184	3536	2024-02-03_5ba65eec431cd353dc06f21197f69453_cryptolocker.exe	88
PID 3536 wrote to memory of 184	3536	2024-02-03_5ba65eec431cd353dc06f21197f69453_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-02-03_5ba65eec431cd353dc06f21197f69453_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_5ba65eec431cd353dc06f21197f69453_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3536
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
44KB

MD5
009cd84dacb4a8752b03643119a05b81

SHA1
4c00b5b450dfcfb925dd3bd0a4c7e8d60905b164

SHA256
12042e1db0d1a11b04b33b432abfa1999eb1e2ab56c602857c3088f68c9ad69e

SHA512
ccee66cf70dd020d38eb0015f0edcb71546c45572d31b9995e6f6f7f6f92d40042f6f52772f2916b222a31a4593098846fc1bbe45326e2840064ae4cbdc481e3

Download Submit
memory/184-21-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/3536-0-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/3536-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3536-1-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download