Analysis

  • max time kernel
    119s
  • max time network
    120s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    09-04-2024 11:07

General

  • Target

    2024-04-09_e716d996f3f0963ef4c8e773dfd20617_cryptolocker.exe

  • Size

    60KB

  • MD5

    e716d996f3f0963ef4c8e773dfd20617

  • SHA1

    dca4d89f76a9b8345c25f38d6cb7dbe5f8ae0567

  • SHA256

    7cb4f9d1903ee8c4168f0db9ae224ddd3eb5ff0107db52c79fb8b488e25caa86

  • SHA512

    612ad5fef7f504099d09bfb2b2dcec15e6fcbbb67747e4d0fbd1753500a31e952306e1139a7065b36e2146dabcdee86e58ffa14a07256dbcc62a94efa45792a3

  • SSDEEP

    1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZw:btng54SMLr+/AO/kIhfoKMHdaw

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-04-09_e716d996f3f0963ef4c8e773dfd20617_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-04-09_e716d996f3f0963ef4c8e773dfd20617_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2120
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2644

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    60KB

    MD5

    1523781f207fdeab27d7abce58283f82

    SHA1

    ca9743a9971331c4b61e138c204fdb4f40890334

    SHA256

    8661248b701aa5bced3884f98b79b6a0b28531deb3cbccfaaf9a0992d5a7bd5e

    SHA512

    f92feb874f59c79557664fe1f6fdc04b5f40fbbe695f928e17676a43babcd2021554598067bc188ec1c61ebc95a59a43506a552c056c4cec153ff1e831736d85

  • memory/2120-0-0x0000000000390000-0x0000000000396000-memory.dmp

    Filesize

    24KB

  • memory/2120-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2120-7-0x0000000000390000-0x0000000000396000-memory.dmp

    Filesize

    24KB

  • memory/2644-17-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

    Filesize

    24KB