36a615d03daa51a730d474e41b445bbdab3db147b04ca2f753694ef6a6f5d447

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exe
Size

63KB
MD5

383c32f3984cef41219eae4f8a952f9d
SHA1

7a4639a17793b48006f7652d719c76f33889cff3
SHA256

36a615d03daa51a730d474e41b445bbdab3db147b04ca2f753694ef6a6f5d447
SHA512

94f31f98955327b2200de60b67e1c7b253766cb0954dc7b4e66c6669fcc482dc8244d13f53f2c14bbf6dfcd631164d2a214f4a208f2a091c20cb62f2dfd1fba2
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnF7HH:btng54SMLr+/AO/kIhfoKMHdaJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\gewos.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exegewos.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

3604 gewos.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
3604	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exe

description	pid	process	target process
PID 4076 wrote to memory of 3604	4076	2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exe	gewos.exe
PID 4076 wrote to memory of 3604	4076	2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exe	gewos.exe
PID 4076 wrote to memory of 3604	4076	2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-23_383c32f3984cef41219eae4f8a952f9d_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4076

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:3604

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3684 --field-trial-handle=2656,i,16940681401824032220,151921362336696246,262144 --variations-seed-version /prefetch:8
1⤵
PID:872

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe
Filesize
63KB

MD5
975a038799f6ab741efc025612ce6849

SHA1
dbfd55859195105e6a15cb6484c6672bf3719a59

SHA256
4575d8e81dcf01e3a666f977a08c41aff8349bd28b281c243a042aa0cc3f094a

SHA512
a3b0f411ed62dbe28da19784db63d6ccb038c8d487c1352b2bd5c8cbcd2a3dbb425dc25e09b8a6a4173b2e9c48c80c00a3a3d62b09ada84a7706f6eebc66c8b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe
Filesize
185B

MD5
bbfd90e47a08dac3fe747a8ec0d0e06b

SHA1
d74c1cf39f78285d4e2733a234e492bf756ad3a9

SHA256
28dda2b5c96b8e09f1182e7a8a55f1f38881822eb745f7d17d4bd5dbb411c2eb

SHA512
4f5449f4fe11c5d25fe7ec786e82a4d1af28ec42db2673c2e419c174ec16c338064c446e05593bdcee5e874afce36f60d384eec43c5b77449de7f8de032f8882

Download Submit
memory/3604-18-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4076-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4076-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/4076-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download