fc15b46ae3d879729369a98ce73149aafb23ffb72c188658d8ea912e7cf64089

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe
Size

61KB
MD5

b508dc077f23ed16674c4e3d5b4e013e
SHA1

0baf3ab97efd8e07200fc8dda978b873742cd427
SHA256

fc15b46ae3d879729369a98ce73149aafb23ffb72c188658d8ea912e7cf64089
SHA512

dfa566900b8cf5ffe8d237735fbedb829b6df9bc9a961e8a023d829b4ae642d25f78b2be064b2cd21c01207391d99c6344e3821c430a7f3c27335cbc3c937916
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHRo:btng54SMLr+/AO/kIhfoKMHdv

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000015c29-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1988	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2852	2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2852	2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe
1988	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 1988	2852	2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe	28
PID 2852 wrote to memory of 1988	2852	2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe	28
PID 2852 wrote to memory of 1988	2852	2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe	28
PID 2852 wrote to memory of 1988	2852	2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_b508dc077f23ed16674c4e3d5b4e013e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1988

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
61KB

MD5
36dbf98d4f7c779bc67073480e83b8c5

SHA1
f13b17939190d4ae1b740c4ef19de8715cb0e73e

SHA256
e3b143a02abf028adfbc29513fc578f98a9e4aa4adb11cb6942b84296ca81ecf

SHA512
6e5ccee2b9cedc5100158d038abbbb0c14e168d11fb1dcce597eeb9d247cf32e1262182d6a86db2b4d2eb05d3e91892c2fbaf49fe7126eb42870e9f65d79f511

Download Submit
memory/1988-23-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/2852-0-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2852-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2852-1-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download