7a00d23e693d4d7008f1bf60919dd9953e11b695daec77f008844870d7bd4b5d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
22/02/2024, 01:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_bf408723238ad49b8bca69e2e5a3b79c_cryptolocker.exe
Size

41KB
MD5

bf408723238ad49b8bca69e2e5a3b79c
SHA1

7b684872314ce33aacd5bdce54f60a81d3ce0f8a
SHA256

7a00d23e693d4d7008f1bf60919dd9953e11b695daec77f008844870d7bd4b5d
SHA512

0d5bbfbfc025fa7f8565914189bc81260e948ca9237cd0ad1e9bef3d55564132ecdb1bf6d09b91fb4f416fba02266341b328f6ca1d5b56a3a994ac51a04cc172
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunrkwIxZdy44S:btB9g/WItCSsAGjX7e9N0hunrknSS

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023204-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	2024-02-22_bf408723238ad49b8bca69e2e5a3b79c_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3316742141-2240921845-2885234760-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
5068	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 5068	640	2024-02-22_bf408723238ad49b8bca69e2e5a3b79c_cryptolocker.exe	86
PID 640 wrote to memory of 5068	640	2024-02-22_bf408723238ad49b8bca69e2e5a3b79c_cryptolocker.exe	86
PID 640 wrote to memory of 5068	640	2024-02-22_bf408723238ad49b8bca69e2e5a3b79c_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-02-22_bf408723238ad49b8bca69e2e5a3b79c_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_bf408723238ad49b8bca69e2e5a3b79c_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:640
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:5068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
41KB

MD5
5c0cc7437bee684f5d82c10b148a1c88

SHA1
dbfa71c551ab01fbacdf31b61f8bbaf7e43d4976

SHA256
3bed6f2cb70f86288f50425662d2e91d22eb9c48cc75a8d5bd89581e3aee5fbc

SHA512
2bfc072bdbb249d3a58f734b92da0d83896ec9101f14374da6f8525d4930768f8f57294e7cef9d158a028a6b7e5b4ede2a286e473ceecc0b10ac563d68f9ba43

Download Submit
memory/640-0-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/640-1-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download
memory/640-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5068-21-0x0000000002020000-0x0000000002026000-memory.dmp

Filesize
24KB

Download