Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
25/05/2024, 00:36
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe
-
Size
63KB
-
MD5
5c038d66be8e4314413c745733883996
-
SHA1
72eadddeafa5d6dd2dfb6cf20ee13a0129c4e8f2
-
SHA256
14fd78050b05f4e997ae15b78a2fe6e3112d47b386bf7f603005b5b7e3bf15d1
-
SHA512
00ed33809181ff12a77287eaa018dad00124b64d498cd7abea4b1d8931dca8e33ce59c669a76eef959201a8d4c36e876004bce33ab4ebedb633a99c824c6079b
-
SSDEEP
1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnF7Hw:btng54SMLr+/AO/kIhfoKMHdaq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x0009000000023410-12.dat CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation gewos.exe -
Executes dropped EXE 1 IoCs
pid Process 4524 gewos.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3740 wrote to memory of 4524 3740 2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe 83 PID 3740 wrote to memory of 4524 3740 2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe 83 PID 3740 wrote to memory of 4524 3740 2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-25_5c038d66be8e4314413c745733883996_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4524
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5ddf126c327089a3ee587bc91641c0724
SHA16e7ab9b2806133024647a293ab3d071e28687d5c
SHA25657324cfb6fe945313417f1d4af1bf1f7ca72d2538583e712864c11ccab199360
SHA51227e1d4b00f0fb0fab36516800bab59334f2679aa2c7c79c6f90d2282821f79623183390b2190cfd25269a6bb7474c0429bc02a7507693f2a38f739993be36f9a
-
Filesize
185B
MD5ec88b457000d8899b0a6ed26578f2c49
SHA18ec598e86916b10851b6d94d497117ab4eb057c3
SHA25638195a8672e27443e3c738ae7170c6cdae3574512bc866a7dba028411e2c467d
SHA512195c1fbe4bebbc1fabe50464f6515be8bfb7d17821439fb49c059aa538fd1bb9b43f36610592819446dd0a1466ab636e0437fc23e994a0df5d09bfc0252b991e