1d7aed231f6e071d70084136f7f0dbee1d17326fb7932cede11d01f59d828486

Analysis

max time kernel
114s
max time network
135s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/04/2024, 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe
Size

55KB
MD5

81cceadd1f9e1c6a02d9d34f365c104e
SHA1

828caaed1ec1e3bc779e7c5fb13551e2d410fd37
SHA256

1d7aed231f6e071d70084136f7f0dbee1d17326fb7932cede11d01f59d828486
SHA512

f8e3607abfa507964fecfeb5c9130bc1a2c8e0501f4448128ca18ce56fef2bc6348b871378bad83dde153c26a5847612a2b98fe08463cdcb65d99f853f295a58
SSDEEP

768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlt:bP9g/xtCS3Dxx0K

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 2 IoCs

resource	yara_rule
behavioral2/memory/1848-0-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0008000000023244-13.dat	CryptoLocker_rule2

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/1848-0-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral2/files/0x0008000000023244-13.dat	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
2740	gewos.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1848-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x0008000000023244-13.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1848 wrote to memory of 2740	1848	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe	90
PID 1848 wrote to memory of 2740	1848	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe	90
PID 1848 wrote to memory of 2740	1848	2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe	90

C:\Users\Admin\AppData\Local\Temp\2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_81cceadd1f9e1c6a02d9d34f365c104e_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1848
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3692 --field-trial-handle=2244,i,11878111470816612087,2265290141962607370,262144 --variations-seed-version /prefetch:8
1⤵
PID:4348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
55KB

MD5
16b1cbc34e6a8e7134c9b613e9a6f0d3

SHA1
a04f00dcacf27c4471b93adc79d493454029e3a3

SHA256
9686b83c5b79963bba89477761610c6837bf298ac4e2cb6b8fc8e0514075ffab

SHA512
a8518e3e797951df4fa47fccc318ca936659206353b114655f90f5728bc2cd9645be7e330866d93fa2d72bff3b01118e954caadf2737c8d1aed99c58dc63804f

Download Submit
memory/1848-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1848-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1848-2-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1848-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2740-21-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download