Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    25/05/2024, 00:36

General

  • Target

    2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe

  • Size

    63KB

  • MD5

    5c038d66be8e4314413c745733883996

  • SHA1

    72eadddeafa5d6dd2dfb6cf20ee13a0129c4e8f2

  • SHA256

    14fd78050b05f4e997ae15b78a2fe6e3112d47b386bf7f603005b5b7e3bf15d1

  • SHA512

    00ed33809181ff12a77287eaa018dad00124b64d498cd7abea4b1d8931dca8e33ce59c669a76eef959201a8d4c36e876004bce33ab4ebedb633a99c824c6079b

  • SSDEEP

    1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnF7Hw:btng54SMLr+/AO/kIhfoKMHdaq

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1120
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2976

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • \Users\Admin\AppData\Local\Temp\gewos.exe

          Filesize

          63KB

          MD5

          ddf126c327089a3ee587bc91641c0724

          SHA1

          6e7ab9b2806133024647a293ab3d071e28687d5c

          SHA256

          57324cfb6fe945313417f1d4af1bf1f7ca72d2538583e712864c11ccab199360

          SHA512

          27e1d4b00f0fb0fab36516800bab59334f2679aa2c7c79c6f90d2282821f79623183390b2190cfd25269a6bb7474c0429bc02a7507693f2a38f739993be36f9a

        • memory/1120-0-0x0000000000290000-0x0000000000296000-memory.dmp

          Filesize

          24KB

        • memory/1120-8-0x0000000000290000-0x0000000000296000-memory.dmp

          Filesize

          24KB

        • memory/1120-1-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2976-16-0x0000000000350000-0x0000000000356000-memory.dmp

          Filesize

          24KB