6758e504ba1f9fd2725b302d5143955e517816ff92c615a7543c79527f1caf80

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
26/04/2024, 18:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-26_44a21bf0fd719fb38667066a7f4179fd_cryptolocker.exe
Size

61KB
MD5

44a21bf0fd719fb38667066a7f4179fd
SHA1

e70d8c80cba7ecec288fa6077df24df64535a027
SHA256

6758e504ba1f9fd2725b302d5143955e517816ff92c615a7543c79527f1caf80
SHA512

3a90f7221ee827d6dcb6cab2294460fea65467ec1b5aac0f8725bb9a77153700111b5d4f553d46cfc3a9a70b2917cd5b027709fdb44da330397f57075ed9c4f1
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnan:btng54SMLr+/AO/kIhfoKMHda4

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000c000000023b4c-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000\Control Panel\International\Geo\Nation	2024-04-26_44a21bf0fd719fb38667066a7f4179fd_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2980	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2980	4368	2024-04-26_44a21bf0fd719fb38667066a7f4179fd_cryptolocker.exe	84
PID 4368 wrote to memory of 2980	4368	2024-04-26_44a21bf0fd719fb38667066a7f4179fd_cryptolocker.exe	84
PID 4368 wrote to memory of 2980	4368	2024-04-26_44a21bf0fd719fb38667066a7f4179fd_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-04-26_44a21bf0fd719fb38667066a7f4179fd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-26_44a21bf0fd719fb38667066a7f4179fd_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
61KB

MD5
f3e6353833d26b55fef953f0d61f928b

SHA1
463d01f285f393653b038dcf76a66e4569cfb469

SHA256
cfbbc1e7b2ae52b678b29b2d658cccc2baa179d53828984164cd784368fc6699

SHA512
e65b18ff68c6ed85b1d1e32f9535a272ddaa8a8e669489dee2cebc996f92d46fdef0d737c5669a4d1169067ef21fd6c9bac04cd66ea80aff5603c60f5654b8ec

Download Submit
memory/2980-25-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/4368-0-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/4368-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4368-8-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download