60a1ddf20dba95b94f053511d5f63b4d3ddb30c60f17296059bd5bbf0c99837e

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
Size

63KB
MD5

cb66f2aaf85b434bd6af3269533cb1f5
SHA1

314fc276a76a34e62b53a26b8d0ed03c9820bd33
SHA256

60a1ddf20dba95b94f053511d5f63b4d3ddb30c60f17296059bd5bbf0c99837e
SHA512

66c0ac7e552f0ef4d673d6bcacd6ed2e365ce05f3b9c05d625006bfba9417be0a662d9f46bb81b9949472f38366f5b805bee1162752a9e3edf10d3249369ac0b
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnx8:btng54SMLr+/AO/kIhfoKMHda2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001444f-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2648	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2380	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2380	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
2648	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2380 wrote to memory of 2648	2380	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe	28
PID 2380 wrote to memory of 2648	2380	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe	28
PID 2380 wrote to memory of 2648	2380	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe	28
PID 2380 wrote to memory of 2648	2380	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2380
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
63KB

MD5
b0b052ca31aaf82ad07052ddcacee9b0

SHA1
7b39d08b13c39ff3bf0da7871ffd758898fc2bb7

SHA256
ffaf2646ba6fab93fd2395fa495312875fbc178f46d2a793c143a801a6afc2b3

SHA512
e8ba1eed4394866feb457b88ef0213fe9d54977923223f7ffb1d466b99245e0ac17dd538ba798be9490c3e775bdfb0307b82b370b5118ea53faa9d3c32401dca

Download Submit
memory/2380-0-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2380-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2380-1-0x00000000005C0000-0x00000000005C6000-memory.dmp

Filesize
24KB

Download
memory/2648-23-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download