0f593b6e45e2379b936887fcc52fc727811728d5022ae4bcd70d108e675387ea

Analysis

max time kernel
133s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exe
Size

36KB
MD5

a1e28c1bd67722209d1dfc46b9e20515
SHA1

c4a34b47bb58c58959eeaa56f5940f6752c7b809
SHA256

0f593b6e45e2379b936887fcc52fc727811728d5022ae4bcd70d108e675387ea
SHA512

30c0b6ef369b30e62e635c0d3ffeb0655ae4b91b8619d769a488d257175fc0c4c7c13fc281ace39bf1f5019aae6243f36c472967dfd1aadf30900e1bcc21b9b9
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qvoLUZ61VQ:btB9g/WItCSsAGjX7r3BTmUQ1VQ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

2328 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2328	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exe

description	pid	process	target process
PID 3724 wrote to memory of 2328	3724	2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exe	gewos.exe
PID 3724 wrote to memory of 2328	3724	2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exe	gewos.exe
PID 3724 wrote to memory of 2328	3724	2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_a1e28c1bd67722209d1dfc46b9e20515_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3724

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:2328

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe
Filesize
37KB

MD5
aaa65b478dab321777acce5dda8a37ef

SHA1
fb47d00786d58d58b4933b0122a3850fe371b9da

SHA256
a58e03c0b8906fce06078bd75a0b594d3a6ef1ced1d53e3df8d2a89c1a6dbcb3

SHA512
f882d08181d914ca7076b786b652de79a040fe1c16156ea44203f4ea3c0c3478f3017d253e5fbfc324920640647b93ac95540793084f9d7ba58a199c6bb57c8e

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Filesize
185B

MD5
25526bcfc74090ded0e2c919a5098789

SHA1
1b6237b5be8b47adfa21d8010beb627de78fc322

SHA256
cfcea18e4bef3f3a8344e1e1695b65240d4a2364dac3ab8857a79fd9679242b7

SHA512
f0268467dd437192bbd80cf4431d22da6c060425f86549c98918102a0528ff922229af5ec02e901d832a3bfc0274e0da8b136059e412eff24fadc65e61afc59c

Download Submit
memory/2328-25-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/3724-0-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/3724-8-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/3724-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download