61c2d84646f17111cb2506da68ca4f875081c4a19aa5ca657fb46135a0084e18

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exe
Size

36KB
MD5

3d7273d8772215421b7d099525882be1
SHA1

844d030fd1c22fdd76c53a77e368200f84d43722
SHA256

61c2d84646f17111cb2506da68ca4f875081c4a19aa5ca657fb46135a0084e18
SHA512

c39d46e305b5a0f1f3f5122ef47da063cf8fd7a74c8229c03b8b7afcc26b7f3aa9b0c88b3b698567a8f0898ab9133df0f8527fa95bfeb8c442b08cfd9b734055
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qZvvoB:btB9g/WItCSsAGjX7r3BTZvvE

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

1096 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1096	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exe

description	pid	process	target process
PID 3156 wrote to memory of 1096	3156	2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exe	gewos.exe
PID 3156 wrote to memory of 1096	3156	2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exe	gewos.exe
PID 3156 wrote to memory of 1096	3156	2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_3d7273d8772215421b7d099525882be1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3156

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:1096

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe
Filesize
36KB

MD5
ef4c7276c011f06d06cc3fb2f86abd0b

SHA1
3ae92f16399a0f5e5c55148eaa1d894ac9cb513e

SHA256
7b549d1b31d902f14497c0cda70f591a835f9c542d671142a11ff9ec00a85422

SHA512
a81c85d3330fa83b6f41dd6f48346132766744e2f2987299f9dc2b3b5ba57e88bb4723852cbdc191ec16fe207fe413c276b30f366dd32f83e56bbc88dfbe9d66

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Filesize
185B

MD5
75ca215a30857cf17a1967d2b0bb4e75

SHA1
94f24f2d0f40a2792b5844e30485dd999a57a042

SHA256
0302a54a5a87278e96d052f7ec7f661ae783f200ec28490a81abe379ee9b6239

SHA512
a32e19ee0e78f88f0df477baf91901db4e134c096a7d942c20e8b5d992d023c2531e74d8fae79df5bd44c29cdb1db73bdeccf7083f4fefaca0eb07f16438040e

Download Submit
memory/1096-25-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/3156-0-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download
memory/3156-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3156-8-0x0000000002150000-0x0000000002156000-memory.dmp

Filesize
24KB

Download