ec2075eae74c1a7c7e481a6a74109eb5b72c8f4a77a0b8c11662d82e67c94cc4

Analysis

max time kernel
118s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
06/04/2024, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe
Size

61KB
MD5

29617a4655e3226cc2326c026cc0cff3
SHA1

40d8c2e01dd72fdf8d561ac399fe7728cac564e8
SHA256

ec2075eae74c1a7c7e481a6a74109eb5b72c8f4a77a0b8c11662d82e67c94cc4
SHA512

ee3babca972a8b425ac0772e8a2835cb2d84545e9dd7732a1ea181d4a7d6f61b43c992a866b500b474aa5998c42284ae3e119bd47560990f6f63f353235903e9
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHOo:btng54SMLr+/AO/kIhfoKMHdW

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001224c-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3036	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
1176	2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1176	2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe
3036	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 3036	1176	2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe	28
PID 1176 wrote to memory of 3036	1176	2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe	28
PID 1176 wrote to memory of 3036	1176	2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe	28
PID 1176 wrote to memory of 3036	1176	2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-06_29617a4655e3226cc2326c026cc0cff3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
61KB

MD5
0f67dd68e807434c38fac3019a575200

SHA1
4c8d685f087b7421686b3cf3e19be0b2468044c5

SHA256
b73f58d8364cc779198eb94ed4a6db6104cbeda69703a78fe19942e9c29a34cf

SHA512
215ca6ea62263d6f6026e9b1c5494b5294ff4150dcdcc23f484a65303280852838324c63d8f3c9ce4c63b25ebde7e3f13766df4211d036caa286b6f6e86509f2

Download Submit
memory/1176-0-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/1176-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1176-2-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/3036-18-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download