7e88f797010987e59d7d7f88e2b6c348afd71e27a83a3d2a41001a926410290f

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exe
Size

36KB
MD5

ccdc921d12fee1153e1cda9cf601621f
SHA1

46a45eb7e24e28cf878f7a2a4efe7d90a9c8cabc
SHA256

7e88f797010987e59d7d7f88e2b6c348afd71e27a83a3d2a41001a926410290f
SHA512

c646ac93285fd383cff5336da7c9f59998975a48d74de4c717f284f18e6bc5d2fb6706673551ec338f563e4e188e8eed985775cf320f00fb77fc31a0b875f917
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qZvv2:btB9g/WItCSsAGjX7r3BTZvv2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

1632 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1632	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exe

description	pid	process	target process
PID 3676 wrote to memory of 1632	3676	2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exe	gewos.exe
PID 3676 wrote to memory of 1632	3676	2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exe	gewos.exe
PID 3676 wrote to memory of 1632	3676	2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_ccdc921d12fee1153e1cda9cf601621f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3676

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1632

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe
Filesize
36KB

MD5
81000de91454a6c1877033757a163ff9

SHA1
d86d562bdfbfb707f5abc3a2a7c2b13cc64bb040

SHA256
5b80fa224c8a4d86bf46a98f6024ae2385ea2ceab2634bfa843028b97e4afb43

SHA512
1a19968f1b5df25e642e86f29938559df6046e3cd3f4c6e611bfabd260bf28662d06f3944210f8488b59673d9aa057735b94ba35183f9b8881085a432e4363d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Filesize
185B

MD5
ebd7fb0840d7cfd65693d7b8766c951d

SHA1
3077f7f078f8f900ed63fe71b6dd93df0fa2f990

SHA256
6c0a8b93433d1cdabfa24e41dbb927b97a7a62c3d33cfce7334ad9a8679196ca

SHA512
d05b11bd8d2e7b3a6c26ac3aea701cee74b8895221d2f2d417e82ce92903bb2d9975e1b6c0697f492dea7cf31a2933ad7e19d6074db8023c13803f8e52814277

Download Submit
memory/1632-25-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/3676-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3676-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3676-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download