13418c68eaeb78aedc2a7b60e92f3ef6a054d1c0cf782c582031cfe6157075ae

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
27/05/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe
Size

63KB
MD5

137362187cdd2496f31fbe56b42f1cef
SHA1

e4c955abc7f406b15479f4a156261c70f0188e44
SHA256

13418c68eaeb78aedc2a7b60e92f3ef6a054d1c0cf782c582031cfe6157075ae
SHA512

e0f22d59fd60583810b4192bc4960d3a5ba061fb4549b612350d9c7fb86666b7806c30ceac362478970c7baaba37a6d9411371ccf0fa57a2cac5fa7e4d596130
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnC:btng54SMLr+/AO/kIhfoKMHdaC

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000e00000001214d-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3000	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
1444	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1444	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe
3000	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 3000	1444	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe	28
PID 1444 wrote to memory of 3000	1444	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe	28
PID 1444 wrote to memory of 3000	1444	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe	28
PID 1444 wrote to memory of 3000	1444	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
63KB

MD5
f691e3fb482c200a0325c483c75ac2a8

SHA1
cd50f66c1bfd4b92ca1c1f24c738bab557613fcd

SHA256
f0bac63f5d59ea974cf0f1a5e15ca0820c7f06759e1437850685aaac39be36ab

SHA512
8695b172692e89d66af7e52bc7c54cff95067048df4491756be2b2bbe229bb1634238e4d99631c3ad952065a9e365a55ea354c3cea7b83a3c70a04e90662bdae

Download Submit
memory/1444-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1444-8-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1444-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/3000-16-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download