a6e87acc20ad6628cb1a6c577b9ec45bcac32e5e46a4bfdb30c7a21366704cf3

Analysis

max time kernel
141s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/03/2024, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-05_7ec6d48a72fd4cea19c8481dfa2a7876_cryptolocker.exe
Size

58KB
MD5

7ec6d48a72fd4cea19c8481dfa2a7876
SHA1

a7c5e2faa442af20f0b04bcf01dbcff8dce524ab
SHA256

a6e87acc20ad6628cb1a6c577b9ec45bcac32e5e46a4bfdb30c7a21366704cf3
SHA512

f2b3efd4dd4702d58831babbff48c4d413969778b9c4c37dc94d5598edd6e2ebc18cf9b4cca3f8273b8c24fdd20e68ee3409ca28a59c8f13edc627b6242a17f9
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHRw:btng54SMLr+/AO/kIhfoKMHdSw

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000700000001e59e-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	2024-03-05_7ec6d48a72fd4cea19c8481dfa2a7876_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
3224	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3584 wrote to memory of 3224	3584	2024-03-05_7ec6d48a72fd4cea19c8481dfa2a7876_cryptolocker.exe	90
PID 3584 wrote to memory of 3224	3584	2024-03-05_7ec6d48a72fd4cea19c8481dfa2a7876_cryptolocker.exe	90
PID 3584 wrote to memory of 3224	3584	2024-03-05_7ec6d48a72fd4cea19c8481dfa2a7876_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-03-05_7ec6d48a72fd4cea19c8481dfa2a7876_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_7ec6d48a72fd4cea19c8481dfa2a7876_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3584
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
58KB

MD5
d908cc616f76ae2f2c207180dd1b8dc8

SHA1
2e52ae12565c90cd93ea51edaa98b7831f15d12b

SHA256
b7fea6c43d0ab01ffcc8a87a348628ce8e4da3dc9cde28ab4d0c1ca948e57a39

SHA512
d06d07817214df405168349587f094eb98e77a55ab84a5b81037fb549ee4f175a13e2958d88c48cf3e72693eb32fc988b941afa2597c57fdf115387c5995c489

Download Submit
memory/3224-25-0x0000000002090000-0x0000000002096000-memory.dmp

Filesize
24KB

Download
memory/3584-0-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/3584-1-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/3584-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download