Analysis

  • max time kernel
    93s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-05-2024 04:11

General

  • Target

    2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe

  • Size

    63KB

  • MD5

    5025c1b320a76283e91b9f3e143daf4b

  • SHA1

    82c312b4a57abca9d4307c04cb88ade72a5a219a

  • SHA256

    91384c1c79533cb492454157175f12a697cde889efb01912011e54ee542ce16d

  • SHA512

    7936c616e7c1c8609242e72da87b8b96df1a7bc53207c0b934f215a8a4518c968489ebf1e3865c4ab2149abf112c7af6d9d2e6d456d0e6992ad177a3a0c126b7

  • SSDEEP

    1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHax2:btng54SMLr+/AO/kIhfoKMHdP2

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-01_5025c1b320a76283e91b9f3e143daf4b_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4284
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4740

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    64KB

    MD5

    7af5214375c3113cf3b0b4744346cc8b

    SHA1

    de9ebd5df0b53a9b60e470f9ec97fb674d404007

    SHA256

    10340964f7d7bf911f8358502ed567e025711db423e14e36da596e5102ca06ea

    SHA512

    95bb7a00b80f0966c68f08fce7011c46def09546aa3c971dad67e509e3a26a9796cf747781a5aabc80ddb91a7709f2379a32380062aac5a3db9b8b68b6bc7035

  • memory/4284-0-0x0000000002110000-0x0000000002116000-memory.dmp

    Filesize

    24KB

  • memory/4284-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4284-8-0x0000000002110000-0x0000000002116000-memory.dmp

    Filesize

    24KB

  • memory/4740-25-0x00000000020A0000-0x00000000020A6000-memory.dmp

    Filesize

    24KB