Analysis

  • max time kernel
    134s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/05/2024, 00:36

General

  • Target

    2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe

  • Size

    63KB

  • MD5

    5c038d66be8e4314413c745733883996

  • SHA1

    72eadddeafa5d6dd2dfb6cf20ee13a0129c4e8f2

  • SHA256

    14fd78050b05f4e997ae15b78a2fe6e3112d47b386bf7f603005b5b7e3bf15d1

  • SHA512

    00ed33809181ff12a77287eaa018dad00124b64d498cd7abea4b1d8931dca8e33ce59c669a76eef959201a8d4c36e876004bce33ab4ebedb633a99c824c6079b

  • SSDEEP

    1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnF7Hw:btng54SMLr+/AO/kIhfoKMHdaq

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:3740
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Checks computer location settings
      • Executes dropped EXE
      PID:4524

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\gewos.exe

          Filesize

          63KB

          MD5

          ddf126c327089a3ee587bc91641c0724

          SHA1

          6e7ab9b2806133024647a293ab3d071e28687d5c

          SHA256

          57324cfb6fe945313417f1d4af1bf1f7ca72d2538583e712864c11ccab199360

          SHA512

          27e1d4b00f0fb0fab36516800bab59334f2679aa2c7c79c6f90d2282821f79623183390b2190cfd25269a6bb7474c0429bc02a7507693f2a38f739993be36f9a

        • C:\Users\Admin\AppData\Local\Temp\gewosik.exe

          Filesize

          185B

          MD5

          ec88b457000d8899b0a6ed26578f2c49

          SHA1

          8ec598e86916b10851b6d94d497117ab4eb057c3

          SHA256

          38195a8672e27443e3c738ae7170c6cdae3574512bc866a7dba028411e2c467d

          SHA512

          195c1fbe4bebbc1fabe50464f6515be8bfb7d17821439fb49c059aa538fd1bb9b43f36610592819446dd0a1466ab636e0437fc23e994a0df5d09bfc0252b991e

        • memory/3740-0-0x00000000021C0000-0x00000000021C6000-memory.dmp

          Filesize

          24KB

        • memory/3740-2-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/3740-8-0x00000000021C0000-0x00000000021C6000-memory.dmp

          Filesize

          24KB

        • memory/4524-25-0x0000000000690000-0x0000000000696000-memory.dmp

          Filesize

          24KB