6cfa09fa8a608ddd353f808c3c0eeb119b3abed7a9626f0d8c8ff298e65e8833

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
04-05-2024 20:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe
Size

55KB
MD5

cb1e56579fb849c57b9c18c6815d0a57
SHA1

6164491bcea5d7ce86cc378403a41bc58a3f809b
SHA256

6cfa09fa8a608ddd353f808c3c0eeb119b3abed7a9626f0d8c8ff298e65e8833
SHA512

9847570d2c24be6321dcb2d0af6db20d5a71f9385d74e719bd477f6968f80be36687b514c0267c0e99cf33562152c49bd4afd83344897bf9f89f7ee086402439
SSDEEP

768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjl+L/:bP9g/xtCS3Dxx0JD

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 3 IoCs

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c00000001565d-11.dat	CryptoLocker_rule2
behavioral1/memory/1964-13-0x0000000000560000-0x000000000056E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 3 IoCs

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral1/files/0x000c00000001565d-11.dat	UPX
behavioral1/memory/1964-13-0x0000000000560000-0x000000000056E000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2888	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
1964	2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1964-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/files/0x000c00000001565d-11.dat	upx
behavioral1/memory/1964-13-0x0000000000560000-0x000000000056E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1964	2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe
2888	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 2888	1964	2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe	28
PID 1964 wrote to memory of 2888	1964	2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe	28
PID 1964 wrote to memory of 2888	1964	2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe	28
PID 1964 wrote to memory of 2888	1964	2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-04_cb1e56579fb849c57b9c18c6815d0a57_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
55KB

MD5
e0b04ce3d40318adb220fb0d4d2a6a35

SHA1
ed36bd1189d8058131bd52e183af681ca4d3b1bb

SHA256
753d19a805a7b2ab5c53e0e13e97b413e22173578f85a8c1ba74559ae162cbeb

SHA512
42802f0b4b2af75ac31efb36feafa6b56c628c40231cba2a0d7abb99923aff6ff4ae8c44a41b51d140f7540d4b50c8b41103c3edba63674878cf30fe55bca927

Download Submit
memory/1964-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1964-9-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/1964-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1964-1-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/1964-13-0x0000000000560000-0x000000000056E000-memory.dmp

Filesize
56KB

Download
memory/2888-25-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download