318b3a30d797d641981ae178da79daf23707bbcefe322f3952067087093aa655

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 05:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe
Size

62KB
MD5

da2fc045c11c827fb1f55e64f898eb93
SHA1

845f462f335ff184ad01eae0962fd2efa59ac217
SHA256

318b3a30d797d641981ae178da79daf23707bbcefe322f3952067087093aa655
SHA512

3736f5a872762ed2ef14548fd97bd3441f30feccd789dd07170c7312da5a3bbda63584ed4fe13604e1982edb95f98f27b94c5f3afb9ba8e55828d49549e4f078
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnF70:btng54SMLr+/AO/kIhfoKMHda2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0006000000023298-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1162180587-977231257-2194346871-1000\Control Panel\International\Geo\Nation	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1796	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 1796	1824	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe	83
PID 1824 wrote to memory of 1796	1824	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe	83
PID 1824 wrote to memory of 1796	1824	2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-10_da2fc045c11c827fb1f55e64f898eb93_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
62KB

MD5
787e6ec6b29e703604ea68528cd1d61d

SHA1
2062ed2afb7c3f51614c131a025c2573d5dc408d

SHA256
162203209ebca05a5aba42e2215f158ac72cf5976e78336ebb1fcdf41ba12665

SHA512
e91c39931a11eefd65832c3ce28ac45968705a891eeccabb7c990b0ec1d96486767607ac47e7c5950fdff966df8b0d9a0e00e0d7c2d4e33e95f8a8ad41f06bd3

Download Submit
memory/1796-25-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/1824-0-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download
memory/1824-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1824-8-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download