8d87fc76f9942f5ad671854450de246ce65e209e6ab3b9490280984bbc0a08b9

Analysis

max time kernel
90s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 04:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-05_ce4fa72af0f80f82dc620a2b7a69fead_cryptolocker.exe
Size

58KB
MD5

ce4fa72af0f80f82dc620a2b7a69fead
SHA1

b2d014ba95c480d986a63ffe011120c5c5eff13a
SHA256

8d87fc76f9942f5ad671854450de246ce65e209e6ab3b9490280984bbc0a08b9
SHA512

2c87a5b19328c84140e2ec9841ae54dd45615bf2231300be941b36d8b69e941b411fd61358baae3cb952312e45716cbae6554cb3ca5bcdb7185529cfccdb806b
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUH4:btng54SMLr+/AO/kIhfoKMHdZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000231fb-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	2024-04-05_ce4fa72af0f80f82dc620a2b7a69fead_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
3532	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1116 wrote to memory of 3532	1116	2024-04-05_ce4fa72af0f80f82dc620a2b7a69fead_cryptolocker.exe	86
PID 1116 wrote to memory of 3532	1116	2024-04-05_ce4fa72af0f80f82dc620a2b7a69fead_cryptolocker.exe	86
PID 1116 wrote to memory of 3532	1116	2024-04-05_ce4fa72af0f80f82dc620a2b7a69fead_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-04-05_ce4fa72af0f80f82dc620a2b7a69fead_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-05_ce4fa72af0f80f82dc620a2b7a69fead_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1116
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
59KB

MD5
0e8aba8de0e4a147e7f3c86b2a0b2e26

SHA1
9c20b392eef41b6a04654e4f92710ccd5b6e889e

SHA256
ea5449e164157aa03a72fb3b8339bac6ddbdf55b2bf608ab0cae18977fdf7dcb

SHA512
8cfe7281583a1566fff7c9ab9b7ec29af474f50b7083390eba9b590f22b160421c464d83f43cb5a1f7dc5566f80b25d70fe2799352687e0be78c323e9dbff554

Download Submit
memory/1116-0-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/1116-1-0x0000000002280000-0x0000000002286000-memory.dmp

Filesize
24KB

Download
memory/1116-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3532-21-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download