13418c68eaeb78aedc2a7b60e92f3ef6a054d1c0cf782c582031cfe6157075ae

Analysis

max time kernel
143s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 18:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe
Size

63KB
MD5

137362187cdd2496f31fbe56b42f1cef
SHA1

e4c955abc7f406b15479f4a156261c70f0188e44
SHA256

13418c68eaeb78aedc2a7b60e92f3ef6a054d1c0cf782c582031cfe6157075ae
SHA512

e0f22d59fd60583810b4192bc4960d3a5ba061fb4549b612350d9c7fb86666b7806c30ceac362478970c7baaba37a6d9411371ccf0fa57a2cac5fa7e4d596130
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnC:btng54SMLr+/AO/kIhfoKMHdaC

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000800000002326c-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
3132	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 3132	1188	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe	91
PID 1188 wrote to memory of 3132	1188	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe	91
PID 1188 wrote to memory of 3132	1188	2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-27_137362187cdd2496f31fbe56b42f1cef_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:3132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4264 --field-trial-handle=2692,i,8678872182442199182,12502579059484928042,262144 --variations-seed-version /prefetch:8
1⤵
PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
63KB

MD5
f691e3fb482c200a0325c483c75ac2a8

SHA1
cd50f66c1bfd4b92ca1c1f24c738bab557613fcd

SHA256
f0bac63f5d59ea974cf0f1a5e15ca0820c7f06759e1437850685aaac39be36ab

SHA512
8695b172692e89d66af7e52bc7c54cff95067048df4491756be2b2bbe229bb1634238e4d99631c3ad952065a9e365a55ea354c3cea7b83a3c70a04e90662bdae

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
c79b2ffa130872a5d8421405a222fd46

SHA1
74a297a3c7d441182b89d0fc85e55c98c238650a

SHA256
4e6eac670141eda954a99a752461f369b35dbf3455f9380d94d44a556589b107

SHA512
785e5d944f4d448778920d40235dc3d4111d10efa9e41cdcf682ac3f04ddbcab91932786e610b54ba61405c3bbb42f1faf55a1517ea790a1b772e8326c125ba9

Download Submit
memory/1188-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1188-1-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/1188-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3132-18-0x0000000000500000-0x0000000000506000-memory.dmp

Filesize
24KB

Download