3cad7c39b9ac4f07985488ded0a6924dd543baaf7d7d5fc28de00c008f9ee169

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 18:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe
Size

39KB
MD5

e645add80b53756fd152966f866b958d
SHA1

df6e545db0346d0238e019391ca665bc6b733ea7
SHA256

3cad7c39b9ac4f07985488ded0a6924dd543baaf7d7d5fc28de00c008f9ee169
SHA512

39f015a981aff5deddafaba4cbb8ddc44144c6a7c3cff5c87321be2036c21ea3baf32e103ee60542b3bfce4a3973bb9bb39b9faa3e0f4703ef0741aced992d63
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunKzH15U/Exn:btB9g/WItCSsAGjX7e9N0hunKLYOn

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012251-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2564	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2932	2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2932	2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe
2564	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 2564	2932	2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe	28
PID 2932 wrote to memory of 2564	2932	2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe	28
PID 2932 wrote to memory of 2564	2932	2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe	28
PID 2932 wrote to memory of 2564	2932	2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_e645add80b53756fd152966f866b958d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2564

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
39KB

MD5
eccd7707f2a4c610876a53743cc8eb56

SHA1
c0babb9a38663532c01e79b944088e0f9011e61d

SHA256
d86cfdb7fab1ee69c96c7908b440475103c6e2b90a4c0c54b8d1bf9d97c93625

SHA512
954e77266f6a64a0edd09798717ed9c380702fb37f4b4da5d951a1e9cef5654b3f7e25da9d663c019555e60434ff64922b23e2fb2efae5b36257405716996b33

Download Submit
memory/2564-23-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2932-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2932-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2932-1-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download