Analysis
-
max time kernel
93s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
01-05-2024 04:11
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe
Resource
win10v2004-20240426-en
General
-
Target
2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe
-
Size
63KB
-
MD5
5025c1b320a76283e91b9f3e143daf4b
-
SHA1
82c312b4a57abca9d4307c04cb88ade72a5a219a
-
SHA256
91384c1c79533cb492454157175f12a697cde889efb01912011e54ee542ce16d
-
SHA512
7936c616e7c1c8609242e72da87b8b96df1a7bc53207c0b934f215a8a4518c968489ebf1e3865c4ab2149abf112c7af6d9d2e6d456d0e6992ad177a3a0c126b7
-
SSDEEP
1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHax2:btng54SMLr+/AO/kIhfoKMHdP2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x000a0000000233c2-12.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation 2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation gewos.exe -
Executes dropped EXE 1 IoCs
pid Process 4740 gewos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4284 wrote to memory of 4740 4284 2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe 84 PID 4284 wrote to memory of 4740 4284 2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe 84 PID 4284 wrote to memory of 4740 4284 2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4740
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
64KB
MD57af5214375c3113cf3b0b4744346cc8b
SHA1de9ebd5df0b53a9b60e470f9ec97fb674d404007
SHA25610340964f7d7bf911f8358502ed567e025711db423e14e36da596e5102ca06ea
SHA51295bb7a00b80f0966c68f08fce7011c46def09546aa3c971dad67e509e3a26a9796cf747781a5aabc80ddb91a7709f2379a32380062aac5a3db9b8b68b6bc7035