dfba773417c20ccb147f2a2a2b7b97e9b845ebcf2fab35528c79b292459e4f7e

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-16_58492c63722d4a3a4272cf3110126299_cryptolocker.exe
Size

61KB
MD5

58492c63722d4a3a4272cf3110126299
SHA1

8e0fe3db112c050978b99ee60142b900b1e1c586
SHA256

dfba773417c20ccb147f2a2a2b7b97e9b845ebcf2fab35528c79b292459e4f7e
SHA512

024af0bad052306393595c2034fbfe914f3aa5fd36c291ab12e4b5cc434da5f1dd9fcd24d5aee9ed4b9ece848fec2ee41a96be6e0f54a899daa81a31c655caa8
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHOXk:btng54SMLr+/AO/kIhfoKMHdC

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00080000000233f4-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-16_58492c63722d4a3a4272cf3110126299_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
4932	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 4932	3820	2024-05-16_58492c63722d4a3a4272cf3110126299_cryptolocker.exe	82
PID 3820 wrote to memory of 4932	3820	2024-05-16_58492c63722d4a3a4272cf3110126299_cryptolocker.exe	82
PID 3820 wrote to memory of 4932	3820	2024-05-16_58492c63722d4a3a4272cf3110126299_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-05-16_58492c63722d4a3a4272cf3110126299_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-16_58492c63722d4a3a4272cf3110126299_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:4932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
61KB

MD5
c6b4f680995ef249424096f14c317379

SHA1
4cd6c0270c79deea52039f679f110ba8984a6a1c

SHA256
da2c05841f57372784d8eecba7f8281c26fb451fff10357819656fd0c2d2163f

SHA512
8fd6c41e6f7801e03d1904ee5193b82de0bf2bd0bcc4b536c3c61389fa2edccff140a709c1aabad0d906e00f35d1986d77f772f5fee15adadd44f1217f56aecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
4722ab14049c067358a0f366042aa03f

SHA1
f73f724b848dc96f2852a42684178299c3d2c061

SHA256
95bbece3f500803780f1605bf1bee15bb49d56168075e68bd9952ef79c91aae0

SHA512
5df3e555be7f034c9a2578d593ed2a614a71549acf528352f58538014e595c783d5a29dbd6be3858ea05e60efdf6e43592ba7b456a0cd21511a69d8a85c3e060

Download Submit
memory/3820-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/3820-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3820-8-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/4932-25-0x00000000005E0000-0x00000000005E6000-memory.dmp

Filesize
24KB

Download