Analysis

  • max time kernel
    140s
  • max time network
    123s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240419-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-05-2024 03:40

General

  • Target

    2024-05-03_678c65dd653483f5f857b0aa27462afb_cryptolocker.exe

  • Size

    63KB

  • MD5

    678c65dd653483f5f857b0aa27462afb

  • SHA1

    d2139819455b4a71d2464b015a57b38219108255

  • SHA256

    4b5929339e5d0f1613983fbe60d23ad3ed40ff6171b805239cd588d75a43ea66

  • SHA512

    806a0b1f6287aaead26bc597dfd22ba944e00415202675fa43c95bce48a71d567ba8080870587fdadc508dda716ad7297ec377744a1a7b19341aa6f5dc83ddfa

  • SSDEEP

    1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHaq:btng54SMLr+/AO/kIhfoKMHdw

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-03_678c65dd653483f5f857b0aa27462afb_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-03_678c65dd653483f5f857b0aa27462afb_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:2156

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\gewos.exe

    Filesize

    63KB

    MD5

    a47c0be8d4f401eb9832a872daed1e56

    SHA1

    fbbbb2548e68abe2a4435fd545db16f227a1f5a0

    SHA256

    da119bc3d7944e2e703964129d41694f045ba916b9edbb6e7e43188147fc771c

    SHA512

    3eb3adb2d63743bd915440c49d58c03cb2ed9d34ae8da966092eff6854c28dd47ceaf173672fe1958d71fe9185f9af8ec7add3b691f2297f437781b09728633d

  • memory/2156-25-0x0000000002160000-0x0000000002166000-memory.dmp

    Filesize

    24KB

  • memory/4948-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB

  • memory/4948-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4948-8-0x00000000021D0000-0x00000000021D6000-memory.dmp

    Filesize

    24KB