f6275f4336fccb4a275fd59cb51ea878cdb2826b4151c17138f17c43e25ea05d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exe
Size

62KB
MD5

17be0e1f59b8a560f0e71d0ccfa759c5
SHA1

f109e2a4da1a4cf01d2e993159007b4247fe029f
SHA256

f6275f4336fccb4a275fd59cb51ea878cdb2826b4151c17138f17c43e25ea05d
SHA512

4a5ff95b25c06a996928273f147d82cb84ba9a5d949d21b813ffac7d83044c141745598e58feed21c82723487aabc2939411e9a6417c4effbb39e17b6a04712a
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnxZ:btng54SMLr+/AO/kIhfoKMHdaf

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

1212 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1212	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exe

description	pid	process	target process
PID 1976 wrote to memory of 1212	1976	2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exe	gewos.exe
PID 1976 wrote to memory of 1212	1976	2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exe	gewos.exe
PID 1976 wrote to memory of 1212	1976	2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_17be0e1f59b8a560f0e71d0ccfa759c5_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
62KB

MD5
05435cffcca9165771ae63565e8cb421

SHA1
02287b719f207ac00b0f4ec819bcdd51886a2b20

SHA256
24d3c6a627c86eaa89de23ba7a0ee6a2d7697c3901c17a0efba69c7b8da776ba

SHA512
b5d6919814997e3bbc11056bfcb97e5fce4ce24296819634245c869f6814e1b2acb6a566b7a188539f8ce666cc07fa6255f60af9a4936f2413d5d8a2d93bbde9

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
105379b15db83b1e6cfed7b029e08f17

SHA1
b8ed44b9cb12dd5ceefd33fcf68cb4886074495a

SHA256
9c0666d7dd456ce16fde5849cae0d1316bfebf4d6597b1abf414b278aee2cb0f

SHA512
62bdf2f546b21c43d4f24c7863622f1a26b7cbc24e4c9a246f70219637a46619c57e0c9833a30683ede0894aab3eb91bd13d299d54c74fbd244fdc6f06df2b0b

Download Submit
memory/1212-25-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/1976-0-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/1976-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1976-8-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download