a4fc2cb3450b07b9a2b6699feedfe29079f7a91524a91228ee9166845a59aca7

Analysis

max time kernel
134s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 21:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe
Size

56KB
MD5

dae9413bd74f86884ddf2cbcd78326f5
SHA1

13d210a9eaf85ef0ebe179c62d98aef8bec4e5ed
SHA256

a4fc2cb3450b07b9a2b6699feedfe29079f7a91524a91228ee9166845a59aca7
SHA512

b880cbb927d511a64038bd2f066eb2b1a34d0dae1b7c90aa06ee71b7b45afd9219357ff18394228d63138ae1e9581c0ce74fc41df6ab7c6a6683b560d12ae4b9
SSDEEP

768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjl+w:bP9g/xtCS3Dxx0Jw

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 2 IoCs

resource	yara_rule
behavioral2/memory/2064-0-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2
behavioral2/files/0x000c000000023b54-13.dat	CryptoLocker_rule2

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/2064-0-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral2/files/0x000c000000023b54-13.dat	UPX

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-877519540-908060166-1852957295-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
4924	gewos.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2064-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x000c000000023b54-13.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 4924	2064	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe	84
PID 2064 wrote to memory of 4924	2064	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe	84
PID 2064 wrote to memory of 4924	2064	2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-03_dae9413bd74f86884ddf2cbcd78326f5_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
56KB

MD5
ce7eb1ce85ea74e7b0f699f1ad3cb6f9

SHA1
627d78a25ded733841d3606e00aef6be0d1cf26a

SHA256
9b8835e4dcea8d328aad2f62786f04696812c9038c5379f75088be550f13b2bb

SHA512
38ac6e4cdb8b706cb893b3a96a34ce9c94c65e8df9336a9f15b87e42248199481a863d55efb4f0ec734d4edf53866196528ae1447768089d3717022e9f4f9264

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
7fae5a586903a0c089a5c79e8e384d8e

SHA1
2b8bb29fac681ee35802332859ad2f80d18a7d68

SHA256
10b597edabf4f85f594a0c7af9791a824a75e56cf9f92997e3565f594e45944f

SHA512
a1a350d4446273256e33a7e81b292290b99d30a9d4f0764d5ba0c5125b9be9b462f5fb660fddaa0b10514892248c08728eebc3e22e9968b4572ebc30999698a0

Download Submit
memory/2064-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2064-1-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/2064-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2064-9-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/4924-26-0x0000000000530000-0x0000000000536000-memory.dmp

Filesize
24KB

Download