c4367f8939e0b0882211c4180a7ff291d5c595b0669391ef4749ad691cd0c703

Analysis

max time kernel
89s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 22:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-13_1b8f047a803b4eec01f9edf8adb943df_cryptolocker.exe
Size

43KB
MD5

1b8f047a803b4eec01f9edf8adb943df
SHA1

938fdd05c0d4a68ed2adb14e0df5beecb137d183
SHA256

c4367f8939e0b0882211c4180a7ff291d5c595b0669391ef4749ad691cd0c703
SHA512

1d25ac8b40cd3cf154a4fe2060d0c108ac7afc7ea1f2377b9413f7e8a6391a2f819699e5819db74c0505c6488a5a4f5930a1823ed9fca4fa0b860cc75c6700ba
SSDEEP

768:btB9g/WItCSsAGjX7r3BPOMHocM4vUUOmJ+96egQW:btB9g/xtCSKfxLIcMzUw96h

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000002323c-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	gewos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-02-13_1b8f047a803b4eec01f9edf8adb943df_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4804	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 4804	3876	2024-02-13_1b8f047a803b4eec01f9edf8adb943df_cryptolocker.exe	84
PID 3876 wrote to memory of 4804	3876	2024-02-13_1b8f047a803b4eec01f9edf8adb943df_cryptolocker.exe	84
PID 3876 wrote to memory of 4804	3876	2024-02-13_1b8f047a803b4eec01f9edf8adb943df_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-02-13_1b8f047a803b4eec01f9edf8adb943df_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-13_1b8f047a803b4eec01f9edf8adb943df_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
43KB

MD5
0bac03aa38748a148b0bda1866b6e219

SHA1
894ed8ef37e6b2ec6a9d8a6b96bcddd3dde9ecee

SHA256
c8d136f449c24f185becc6ebeea484964f7d74e4764fae4f502f33175e111eb4

SHA512
c8f94dba9820aa785d392a1faff9168503fa8a7de55e6c9e98b87decd48ec3dcdc609554c809da44d6bbe61025f76cf366297616065ab66f9df1bf96c6b14483

Download Submit
memory/3876-0-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/3876-1-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/3876-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4804-20-0x0000000000790000-0x0000000000796000-memory.dmp

Filesize
24KB

Download