de7d9b84b39bf9871d526d27fbf17b760e369e95ec71fa9ee9d41d6604ca218c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exe
Size

36KB
MD5

57e2d520d3cdf604bbeab8311c1a4ad5
SHA1

357448937b3e0ce40833dea8d2ae09c7c38a4c62
SHA256

de7d9b84b39bf9871d526d27fbf17b760e369e95ec71fa9ee9d41d6604ca218c
SHA512

c9ebfb3418449eee995c5a36e4dfeaba01410b309bc28cf470e0d4ddcec63fb6776d0c277994c5f0d77a3958e58d3b0065dbb54801022f00a4f4d4f1caf635a4
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qG1H0:btB9g/WItCSsAGjX7r3BTa0

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

1624 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1624	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exe

description	pid	process	target process
PID 5032 wrote to memory of 1624	5032	2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exe	gewos.exe
PID 5032 wrote to memory of 1624	5032	2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exe	gewos.exe
PID 5032 wrote to memory of 1624	5032	2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_57e2d520d3cdf604bbeab8311c1a4ad5_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:5032

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1624

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe
Filesize
36KB

MD5
88831708c53ae57ce92425b73219195a

SHA1
e4d9e2c1f0e8a84e921b4e2b9e3aa240a63c9b03

SHA256
9c9c226c2a9c8b172522ccf45904170c122aafedbd0036b6534fff0141985588

SHA512
28f3d6b27d41d6e0a3cc20a81b90ee193df1e1dd08e5cc06db4445e4008b3ec59b9ee5c342812fa55295850fad42bd08f2a24b806b703697c6c041610c54d890

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Filesize
185B

MD5
952f6b5050b94ea06149fe4960fd9373

SHA1
74afc62f3d9e569820782bba63f96159913767d1

SHA256
400bfaac51740af2b0986d9da4ac9f385ca96ff6c03db3772b741ace6bf913a7

SHA512
fe646c679223c32e7f9ae6d26d6a218cd535cf4b328406537d8fd5b8b580f6c2873376899d8419395ad667d03a014462a29ef9fe84a14adabced55ae14cef304

Download Submit
memory/5032-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/5032-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5032-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download