dd3e3d88e11ace4e1db0c57fa2e2db9e9e7975d5545d882b8bb4dab06a6f00f9

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exe
Size

39KB
MD5

855d7123fb5d9f5122b0f336b4385a91
SHA1

c2d8c5802819f0e40b47d9ecbf5041ecf3c15acc
SHA256

dd3e3d88e11ace4e1db0c57fa2e2db9e9e7975d5545d882b8bb4dab06a6f00f9
SHA512

dfd68409bc5dd740f2277813c93536e84dfd4c1a6494292dbe110cede9fb772f17eda72a82d105eb208d935d53fa6c1ecc0fef1261ba8b335b16b6620e125320
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunRSyHmYvV82:btB9g/WItCSsAGjX7e9N0hunRvGIV82

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

4460 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
4460	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exe

description	pid	process	target process
PID 228 wrote to memory of 4460	228	2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exe	gewos.exe
PID 228 wrote to memory of 4460	228	2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exe	gewos.exe
PID 228 wrote to memory of 4460	228	2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_855d7123fb5d9f5122b0f336b4385a91_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:228

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4460

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe
Filesize
39KB

MD5
74cb50eaf7e7c4d6159f8f572dcc3b2a

SHA1
471296a20f616e959f8b3d8829f12785a2c45621

SHA256
39829cdd21407927cd69c9a82e56aa1eac669583f37e80bb3b4d32de3c3fb8be

SHA512
acaad96dc7062050b8bdfc38d0709c62a06a75e2a2564cbe8b0fffac2f10ed6b23ce6ce056a0a6ffea3f5b580b1687e1aef51eaee97b2ead0d2aaf04c7c78f2a

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Filesize
185B

MD5
8d5a7f5bc562712672290d7bfd091b35

SHA1
99991808c3c87fb7f878feb07ec9c4512e372885

SHA256
0474868ee6525c917c51c12930250add59ff581a83b5a87e11d44919e81bedb4

SHA512
7b0980e5ba17b1b519c72ba1ab6b60a2abee7bf4070d8b6706fdde468a5b9d0c028b3482fb4769ee622fd58e14e00d2914fad52648494c91a32ba6cf73df0f47

Download Submit
memory/228-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/228-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/228-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4460-25-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download