cfd66efa89bd3078bffbbbb18f2c0eab605809b6f0e857809f6f2ce492126856

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 15:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-30_f9e7f0ce9bd2152f142bf0b2658185e8_cryptolocker.exe
Size

55KB
MD5

f9e7f0ce9bd2152f142bf0b2658185e8
SHA1

7aadaf1bafd102a290cbae3723db65728e912300
SHA256

cfd66efa89bd3078bffbbbb18f2c0eab605809b6f0e857809f6f2ce492126856
SHA512

84ac6f26e5431cb73509495b1758f8c53f6c0b7a51139c7763e0656a8d42d8828fda2097e27124b06c765112157d633246db05d6f43ba80e35c09dca4d98419e
SSDEEP

768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjNp:bP9g/xtCS3Dxx02

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral2/memory/964-0-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x0007000000023305-13.dat	CryptoLocker_rule2
behavioral2/memory/3212-18-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral2/memory/964-0-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral2/files/0x0007000000023305-13.dat	UPX
behavioral2/memory/3212-18-0x0000000000400000-0x000000000040E000-memory.dmp	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	2024-04-30_f9e7f0ce9bd2152f142bf0b2658185e8_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
3212	gewos.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/964-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x0007000000023305-13.dat	upx
behavioral2/memory/3212-18-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 3212	964	2024-04-30_f9e7f0ce9bd2152f142bf0b2658185e8_cryptolocker.exe	82
PID 964 wrote to memory of 3212	964	2024-04-30_f9e7f0ce9bd2152f142bf0b2658185e8_cryptolocker.exe	82
PID 964 wrote to memory of 3212	964	2024-04-30_f9e7f0ce9bd2152f142bf0b2658185e8_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-04-30_f9e7f0ce9bd2152f142bf0b2658185e8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-30_f9e7f0ce9bd2152f142bf0b2658185e8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:964
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
55KB

MD5
f7428ebb29325cb377cd8f006c483c9f

SHA1
3bb835dd143c5a1034690c48997bc1a89ee7e133

SHA256
44c621d5f68257c7e16134c8c1fb6b3accb940815f7e8f1eb4a6904e45ae3860

SHA512
73617212b8129d81c0003b17fea533edfb11b04dde5449cfc7558c0d40100d0b33935866bdd19a704684074700918126c335e1d127799b79f4b51efececc2bb3

Download Submit
memory/964-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/964-1-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/964-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/964-9-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/3212-18-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3212-27-0x00000000006B0000-0x00000000006B6000-memory.dmp

Filesize
24KB

Download