1d7aed231f6e071d70084136f7f0dbee1d17326fb7932cede11d01f59d828486

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
24-04-2024 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe
Size

55KB
MD5

81cceadd1f9e1c6a02d9d34f365c104e
SHA1

828caaed1ec1e3bc779e7c5fb13551e2d410fd37
SHA256

1d7aed231f6e071d70084136f7f0dbee1d17326fb7932cede11d01f59d828486
SHA512

f8e3607abfa507964fecfeb5c9130bc1a2c8e0501f4448128ca18ce56fef2bc6348b871378bad83dde153c26a5847612a2b98fe08463cdcb65d99f853f295a58
SSDEEP

768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlt:bP9g/xtCS3Dxx0K

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral1/memory/2964-0-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000012249-11.dat	CryptoLocker_rule2
behavioral1/memory/2556-16-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/2964-0-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral1/files/0x000c000000012249-11.dat	UPX
behavioral1/memory/2556-16-0x0000000000400000-0x000000000040E000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2556	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2964	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2964-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/files/0x000c000000012249-11.dat	upx
behavioral1/memory/2556-16-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2964	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe
2556	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2556	2964	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe	28
PID 2964 wrote to memory of 2556	2964	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe	28
PID 2964 wrote to memory of 2556	2964	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe	28
PID 2964 wrote to memory of 2556	2964	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
55KB

MD5
16b1cbc34e6a8e7134c9b613e9a6f0d3

SHA1
a04f00dcacf27c4471b93adc79d493454029e3a3

SHA256
9686b83c5b79963bba89477761610c6837bf298ac4e2cb6b8fc8e0514075ffab

SHA512
a8518e3e797951df4fa47fccc318ca936659206353b114655f90f5728bc2cd9645be7e330866d93fa2d72bff3b01118e954caadf2737c8d1aed99c58dc63804f

Download Submit
memory/2556-16-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2556-25-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2964-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2964-1-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2964-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2964-9-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download