8004e34e799e86595144b08cfc5cf383d4c5ab5461aabd6f0ca394e92f5820a4

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10/04/2024, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe
Size

34KB
MD5

897c91b85a3fdcb75b75aa1744fdd5ab
SHA1

e01ed0204ed772a9b2483b324739e5a2398ff69a
SHA256

8004e34e799e86595144b08cfc5cf383d4c5ab5461aabd6f0ca394e92f5820a4
SHA512

17136a19029e97e201221f62d119b965fd619cde12b2e9e2326e46fa8046f98c8d7c33737b1b4a31e227d5860f8946df8674aaad678021eed9ef4a8c963a42a9
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qI:btB9g/WItCSsAGjX7r3BTI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012254-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2500	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2384	2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2384	2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe
2500	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 2500	2384	2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe	28
PID 2384 wrote to memory of 2500	2384	2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe	28
PID 2384 wrote to memory of 2500	2384	2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe	28
PID 2384 wrote to memory of 2500	2384	2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-10_897c91b85a3fdcb75b75aa1744fdd5ab_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
34KB

MD5
bd4a1a44b454d9e4d69b095bbd7159cf

SHA1
9f1ba8c801e0d0008d215c462fef257fffc54e9f

SHA256
05a7b0726b526630267a58e0c3d00b4637fd728f91b8f482a8510397414e6090

SHA512
a276c50c835b71a16d26fb5a933f3f5baee73d3fcf647b1e11c42deab7bf4b5060a2c4cb66a613b890955bc0b34de6099b17326ab2a940a10ad0111510a76907

Download Submit
memory/2384-0-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2384-1-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2384-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2500-23-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download