878ae8ce38f7533c8dbea5487b96fec911444285d336cdccadcce4f76532620c

Analysis

max time kernel
130s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 06:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_fdac97facbc40114d105358e9eb662af_cryptolocker.exe
Size

62KB
MD5

fdac97facbc40114d105358e9eb662af
SHA1

66f3f61ef801167da8a4d96cd7a2788ebbec7d86
SHA256

878ae8ce38f7533c8dbea5487b96fec911444285d336cdccadcce4f76532620c
SHA512

657c6188a1ae247623dcde498616c1278fbf3b78edd1795885f1fffad3fb9d1472f8723a44f960c2fba32f55ea5cc235cffd28a90720a701e38c96050ad36c3e
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnxo:btng54SMLr+/AO/kIhfoKMHda6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000002327d-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	2024-05-22_fdac97facbc40114d105358e9eb662af_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
3924	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3924	4524	2024-05-22_fdac97facbc40114d105358e9eb662af_cryptolocker.exe	83
PID 4524 wrote to memory of 3924	4524	2024-05-22_fdac97facbc40114d105358e9eb662af_cryptolocker.exe	83
PID 4524 wrote to memory of 3924	4524	2024-05-22_fdac97facbc40114d105358e9eb662af_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-22_fdac97facbc40114d105358e9eb662af_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_fdac97facbc40114d105358e9eb662af_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
62KB

MD5
b6f68f56813bc85bddfb71b4b208d130

SHA1
952cce375dde8bfc5bc665434c29e73f956c7056

SHA256
5b4d0f98953bc00f9e2926a4317836339e06974d8b15449470485de6da026393

SHA512
3cca1ad4aafb408010d0f3e0722326a593a9a7ef1174ed7cf5cf3d47d0e7a3eee252a5ea2e537545e33e8537fcbadd6e8f02650a38cf570f6421552cf355067c

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
289563254392f9e740d59a28fd565b35

SHA1
ba2cc8e2b1cbe867f9805ff7b32c3e452f58ef34

SHA256
dc4616f90e23e579a8ee85b337c5d6f4deff82bf622e2d5ec3ecaba827341656

SHA512
de0933604152eec85fa4006df8c6a66212e7cce9c1e7361557b04448e90bb11a87a72dcb804928e3f4607fe981fe49b2f89f4e8c1698f242e131b3c4fe94720f

Download Submit
memory/3924-25-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/4524-0-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/4524-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4524-8-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download