9d12430e2e2c203b1a45161bc239ad2effdc9d48607f4e6a127b8c977ba13161

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
19/05/2024, 20:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe
Size

62KB
MD5

1d9ad202ae95751fe92a5eab7d13a6e5
SHA1

9d779da7134de4a88cc6f1c17b71900405360bc1
SHA256

9d12430e2e2c203b1a45161bc239ad2effdc9d48607f4e6a127b8c977ba13161
SHA512

c71ccf1a7701d1b727401f4602d515d7dc944857e801790d480a4ba6fe371325409905ff94b18130bb1a5514755f0c918985521afa564c18247d78b64cfbc07f
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnx7:btng54SMLr+/AO/kIhfoKMHda9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001444f-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2880	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2380	2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe
2880	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2880	2380	2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe	28
PID 2380 wrote to memory of 2880	2380	2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe	28
PID 2380 wrote to memory of 2880	2380	2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe	28
PID 2380 wrote to memory of 2880	2380	2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-19_1d9ad202ae95751fe92a5eab7d13a6e5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2880

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
62KB

MD5
3acc8325dd382ee5e209863f31c60181

SHA1
e7d0ac3c6daa7cd70568553867b7220077950b13

SHA256
42e5c1041414931ddd9f57ff0d09c8005a9dd1e675eaa4a0508715e8575c5a30

SHA512
831d7335522b7904df8d5c6faa3fbcbb11174266db1c8d60be96cf969683fc01d5b429a372c74cea16dcb29e0485a12ab20fbf5cd44d3dd3c57f86b4600f1e9f

Download Submit
memory/2380-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2380-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2380-8-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2880-23-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download