6dc0e66e710da16bd0e60fbece3ea0ee8afa984520719fd4a35d964f3d035bf5

Analysis

max time kernel
121s
max time network
125s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
05/05/2024, 07:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe
Size

56KB
MD5

e10d5dd516fd47a290807c0d8ece64c2
SHA1

61818296342ea53b32d5e7cec55fd7ad0b0af3ed
SHA256

6dc0e66e710da16bd0e60fbece3ea0ee8afa984520719fd4a35d964f3d035bf5
SHA512

cfd5ad88d8dbad5b0ac26dc8ab58a3379583409be189ce6c6e7146d8bb42e3a8fed958d81f7163f5fe8d3b396cbecfe0fd497e07ddc82705de124af1f67f29bc
SSDEEP

768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlgzy:bP9g/xtCS3Dxx0ny

Score

9^/10

upx

Malware Config

Signatures

Detection of CryptoLocker Variants 4 IoCs

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2
behavioral1/files/0x000c000000013a88-11.dat	CryptoLocker_rule2
behavioral1/memory/2060-13-0x00000000007B0000-0x00000000007BE000-memory.dmp	CryptoLocker_rule2
behavioral1/memory/2180-17-0x0000000000400000-0x000000000040E000-memory.dmp	CryptoLocker_rule2

UPX dump on OEP (original entry point) 4 IoCs

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000400000-0x000000000040E000-memory.dmp	UPX
behavioral1/files/0x000c000000013a88-11.dat	UPX
behavioral1/memory/2060-13-0x00000000007B0000-0x00000000007BE000-memory.dmp	UPX
behavioral1/memory/2180-17-0x0000000000400000-0x000000000040E000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
2180	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2060-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/files/0x000c000000013a88-11.dat	upx
behavioral1/memory/2060-13-0x00000000007B0000-0x00000000007BE000-memory.dmp	upx
behavioral1/memory/2180-17-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2060	2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe
2180	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2180	2060	2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe	28
PID 2060 wrote to memory of 2180	2060	2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe	28
PID 2060 wrote to memory of 2180	2060	2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe	28
PID 2060 wrote to memory of 2180	2060	2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-05_e10d5dd516fd47a290807c0d8ece64c2_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
56KB

MD5
3c6dd3f5eb222cf202727d268b3d9873

SHA1
c9910ff95f52c05df7b480af29d9d574235d62fc

SHA256
c005367f254b3f9b89a06909e1595d08bb8fbbd6aa687e6d63368b64983a21b0

SHA512
42be9c23dc2395bbbe7d9d5d0afdc6177a54f068c7b7272392ae2f4b7bf1f60a4b5067636ee1a630ec7e6f4265903b2aa05fe464980b712b3306fe841089894b

Download Submit
memory/2060-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2060-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2060-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2060-9-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2060-13-0x00000000007B0000-0x00000000007BE000-memory.dmp

Filesize
56KB

Download
memory/2180-17-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download