4d06b199e76f031fecafcdd9ec1cd9cc14e0a4db5f13adeca442c10ad41852a5

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 15:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe
Size

63KB
MD5

cf5e5b56266476c1eb498784ac6065c7
SHA1

ed7c58e12da6ad13b948e217d7eb48a7006959de
SHA256

4d06b199e76f031fecafcdd9ec1cd9cc14e0a4db5f13adeca442c10ad41852a5
SHA512

fea75339a7bda329d10566f69fe298d1daa1ba07b5ca7c4b3c33ffdf2c4dee8684d39c688f8622937268b958c8486e24ba431a3744bbd434596f34d49b2daaac
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnF:btng54SMLr+/AO/kIhfoKMHdaF

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

gewos.exe2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	gewos.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation	2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

1524 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1524	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe

description	pid	process	target process
PID 1608 wrote to memory of 1524	1608	2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe	gewos.exe
PID 1608 wrote to memory of 1524	1608	2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe	gewos.exe
PID 1608 wrote to memory of 1524	1608	2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1608

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
63KB

MD5
661575220c5cb21214f098d2331ddb35

SHA1
5f9b7e275872476b2fa3c90922ed549a4873b881

SHA256
59f447ad02e190f2f6f564c5736306c9f4327ed0b8471ea18199f13d0836809e

SHA512
1579db811f45665b481eed6ef6b0a95706c4d68b75cff3e2684df1b912116b22390d479055e3d4d696bf75acfcfe4d71f20be4c08878f0a38d0c76a95eb843a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
ab11ea8fc7b1cf9a83df3c13d766d537

SHA1
6d33074302fac60b939d9626e160971ae2a7f12c

SHA256
a1b1d53398ee8a83acbcee9e43dad108e09ae2bf09f7c3fb8e7b7ca7551d1db3

SHA512
e736dafcdd844261641adbe92459b39046367d4fed60ab852a4dc9ba6feca5b8c359cc841be29fd56431298b1cecc3cf14a6d8b6d264e2d0f269ff9eb9c24738

Download Submit
memory/1524-25-0x0000000001F30000-0x0000000001F36000-memory.dmp

Filesize
24KB

Download
memory/1608-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1608-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1608-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download