Analysis

  • max time kernel
    117s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    06/06/2024, 20:34

General

  • Target

    2024-06-06_926baeaa3db5decb93c1bc7e7b538199_cryptolocker.exe

  • Size

    37KB

  • MD5

    926baeaa3db5decb93c1bc7e7b538199

  • SHA1

    7c53c8e6c6107e96c7196560cdda0482eaf8b75f

  • SHA256

    fe6351bc6062a3c49f8d60e420d69118362ad1d1992d8d921abd64af36d9b2ee

  • SHA512

    17ef76d0e6c50d73315be4ddc3e2a91ed01df3aff7d81ae265ab8bd88f9366d7580e157a1df77daa04d9dc8f62bbaac6e5801fa2605a97aba540656246139f7b

  • SSDEEP

    384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunRSyN:btB9g/WItCSsAGjX7e9N0hunRvN

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-06_926baeaa3db5decb93c1bc7e7b538199_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-06_926baeaa3db5decb93c1bc7e7b538199_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2648
    • C:\Users\Admin\AppData\Local\Temp\gewos.exe
      "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      • Suspicious use of UnmapMainImage
      PID:2384

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

          Filesize

          70KB

          MD5

          49aebf8cbd62d92ac215b2923fb1b9f5

          SHA1

          1723be06719828dda65ad804298d0431f6aff976

          SHA256

          b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

          SHA512

          bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

        • \Users\Admin\AppData\Local\Temp\gewos.exe

          Filesize

          37KB

          MD5

          eca8f38e31cfb028091d12899b09780f

          SHA1

          de04a0efe4051c9accb6d1561d26c1525c5afe0b

          SHA256

          6295503c8f52743b327e61dbaa47e32203267f619093502df637353b6310d996

          SHA512

          603417155b65b1ded51b6270c6afaee0278fd1ae696c6b493d81dbbb39190085e96807357b7849055e7b1bac0d07310fca45c5d5919015c82f0f1f4cee79f973

        • memory/2384-23-0x00000000003E0000-0x00000000003E6000-memory.dmp

          Filesize

          24KB

        • memory/2648-8-0x0000000000490000-0x0000000000496000-memory.dmp

          Filesize

          24KB

        • memory/2648-1-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/2648-0-0x0000000000490000-0x0000000000496000-memory.dmp

          Filesize

          24KB