fbb63c5c98348355cbb524e3377cbaf51ac2038d1d46c5d44e65a4da41a577bb

Analysis

max time kernel
150s
max time network
169s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05-03-2024 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-05_9a12b616c6516a232ab28de852faad77_cryptolocker.exe
Size

61KB
MD5

9a12b616c6516a232ab28de852faad77
SHA1

077ec0b156f02681ee064f097122af41f4e23df9
SHA256

fbb63c5c98348355cbb524e3377cbaf51ac2038d1d46c5d44e65a4da41a577bb
SHA512

7ae70391d9ce4755134f4c46ca5846158f10794f9f2ae21e54c98963c354b0ecb84ca72a93de12051683ea0f16f8e5400833deb46a25be5700cd2e42cf8cdbee
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHOC:btng54SMLr+/AO/kIhfoKMHdU

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000a00000002322b-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-03-05_9a12b616c6516a232ab28de852faad77_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
212	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 212	3464	2024-03-05_9a12b616c6516a232ab28de852faad77_cryptolocker.exe	99
PID 3464 wrote to memory of 212	3464	2024-03-05_9a12b616c6516a232ab28de852faad77_cryptolocker.exe	99
PID 3464 wrote to memory of 212	3464	2024-03-05_9a12b616c6516a232ab28de852faad77_cryptolocker.exe	99

C:\Users\Admin\AppData\Local\Temp\2024-03-05_9a12b616c6516a232ab28de852faad77_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-05_9a12b616c6516a232ab28de852faad77_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:212

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3772 --field-trial-handle=2284,i,15722001240173834669,15048020084704567542,262144 --variations-seed-version /prefetch:8
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
61KB

MD5
c0122f486154cd7b988cb7a67947b8c8

SHA1
6c291cfb00c485df7c83ef8088470bc93c2c9378

SHA256
0e1cd5a713d4fe59a0d283739a18ea489aaa4d02179a4fcb96c499787923e2be

SHA512
fc5cf14f3cc7a96a8246df73875d031b2a598af5084ff51209ad509b2d52f72772859b1aaa5ded79a12961d9175d0b9c9feed14be93efe11169382325705f342

Download Submit
memory/212-19-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/3464-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/3464-2-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/3464-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download