318b3a30d797d641981ae178da79daf23707bbcefe322f3952067087093aa655

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10/05/2024, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe
Size

62KB
MD5

da2fc045c11c827fb1f55e64f898eb93
SHA1

845f462f335ff184ad01eae0962fd2efa59ac217
SHA256

318b3a30d797d641981ae178da79daf23707bbcefe322f3952067087093aa655
SHA512

3736f5a872762ed2ef14548fd97bd3441f30feccd789dd07170c7312da5a3bbda63584ed4fe13604e1982edb95f98f27b94c5f3afb9ba8e55828d49549e4f078
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnF70:btng54SMLr+/AO/kIhfoKMHda2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001227b-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1932	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2976	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2976	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe
1932	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2976 wrote to memory of 1932	2976	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe	28
PID 2976 wrote to memory of 1932	2976	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe	28
PID 2976 wrote to memory of 1932	2976	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe	28
PID 2976 wrote to memory of 1932	2976	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2976
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
62KB

MD5
787e6ec6b29e703604ea68528cd1d61d

SHA1
2062ed2afb7c3f51614c131a025c2573d5dc408d

SHA256
162203209ebca05a5aba42e2215f158ac72cf5976e78336ebb1fcdf41ba12665

SHA512
e91c39931a11eefd65832c3ce28ac45968705a891eeccabb7c990b0ec1d96486767607ac47e7c5950fdff966df8b0d9a0e00e0d7c2d4e33e95f8a8ad41f06bd3

Download Submit
memory/1932-23-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2976-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2976-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2976-8-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download