a4fc2cb3450b07b9a2b6699feedfe29079f7a91524a91228ee9166845a59aca7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-05-2024 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe
Size

56KB
MD5

dae9413bd74f86884ddf2cbcd78326f5
SHA1

13d210a9eaf85ef0ebe179c62d98aef8bec4e5ed
SHA256

a4fc2cb3450b07b9a2b6699feedfe29079f7a91524a91228ee9166845a59aca7
SHA512

b880cbb927d511a64038bd2f066eb2b1a34d0dae1b7c90aa06ee71b7b45afd9219357ff18394228d63138ae1e9581c0ce74fc41df6ab7c6a6683b560d12ae4b9
SSDEEP

768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjl+w:bP9g/xtCS3Dxx0Jw

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000d000000014698-11.dat	CryptoLocker_rule2
behavioral1/memory/1960-16-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral1/files/0x000d000000014698-11.dat	UPX
behavioral1/memory/1960-16-0x0000000000400000-0x000000000040E000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
1960	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2888	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2888-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/files/0x000d000000014698-11.dat	upx
behavioral1/memory/1960-16-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2888	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe
1960	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 1960	2888	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe	28
PID 2888 wrote to memory of 1960	2888	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe	28
PID 2888 wrote to memory of 1960	2888	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe	28
PID 2888 wrote to memory of 1960	2888	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
56KB

MD5
ce7eb1ce85ea74e7b0f699f1ad3cb6f9

SHA1
627d78a25ded733841d3606e00aef6be0d1cf26a

SHA256
9b8835e4dcea8d328aad2f62786f04696812c9038c5379f75088be550f13b2bb

SHA512
38ac6e4cdb8b706cb893b3a96a34ce9c94c65e8df9336a9f15b87e42248199481a863d55efb4f0ec734d4edf53866196528ae1447768089d3717022e9f4f9264

Download Submit
memory/1960-16-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1960-18-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2888-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2888-1-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2888-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/2888-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download