cc7732f54af217e534fa9f4ce8f094336425e9b87a3c0e637be6e4de0216f23d

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe
Size

37KB
MD5

68349d5ee00cd298e6d15edc93bc79ae
SHA1

4a361c9c26284aae6da9f0746a058ee0b5ccd280
SHA256

cc7732f54af217e534fa9f4ce8f094336425e9b87a3c0e637be6e4de0216f23d
SHA512

b2da8a82fc1a8ba3cd8276b9d5383fa99e4222ed455bb3b8044b69a31d1dc889c7d19f97ffeadf1d261e6c7f304a418682945d50850e9511671a8527903a5a48
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qvoLUZ61VSl3m:btB9g/WItCSsAGjX7r3BTmUQ1VmC0o

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d00000001449a-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2508	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
1904	2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1904	2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe
2508	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 2508	1904	2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe	28
PID 1904 wrote to memory of 2508	1904	2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe	28
PID 1904 wrote to memory of 2508	1904	2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe	28
PID 1904 wrote to memory of 2508	1904	2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-03_68349d5ee00cd298e6d15edc93bc79ae_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
37KB

MD5
616833336c9d60a5c1f3a0d948a3fa1c

SHA1
0f542f7be6993290d86fb232303be640db4d00b9

SHA256
e446aa78264c4210541f5b36f9583923936d5aa91e41f912e0f9661f54b57b8c

SHA512
4d0ddf188999636843fb0c242f9477cb6ed1b18ae24672d748d250c9e12b00b9e24fefa61aa8a5eafce51bce1ccbe4f06ddc1204d5bd0f28089ad1418d0347fb

Download Submit
memory/1904-8-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/1904-0-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/1904-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2508-23-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download