60a1ddf20dba95b94f053511d5f63b4d3ddb30c60f17296059bd5bbf0c99837e

Analysis

max time kernel
93s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 06:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
Size

63KB
MD5

cb66f2aaf85b434bd6af3269533cb1f5
SHA1

314fc276a76a34e62b53a26b8d0ed03c9820bd33
SHA256

60a1ddf20dba95b94f053511d5f63b4d3ddb30c60f17296059bd5bbf0c99837e
SHA512

66c0ac7e552f0ef4d673d6bcacd6ed2e365ce05f3b9c05d625006bfba9417be0a662d9f46bb81b9949472f38366f5b805bee1162752a9e3edf10d3249369ac0b
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnx8:btng54SMLr+/AO/kIhfoKMHda2

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00090000000233ea-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
1804	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3904 wrote to memory of 1804	3904	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe	82
PID 3904 wrote to memory of 1804	3904	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe	82
PID 3904 wrote to memory of 1804	3904	2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe	82

C:\Users\Admin\AppData\Local\Temp\2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-10_cb66f2aaf85b434bd6af3269533cb1f5_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3904
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  PID:1804

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
63KB

MD5
b0b052ca31aaf82ad07052ddcacee9b0

SHA1
7b39d08b13c39ff3bf0da7871ffd758898fc2bb7

SHA256
ffaf2646ba6fab93fd2395fa495312875fbc178f46d2a793c143a801a6afc2b3

SHA512
e8ba1eed4394866feb457b88ef0213fe9d54977923223f7ffb1d466b99245e0ac17dd538ba798be9490c3e775bdfb0307b82b370b5118ea53faa9d3c32401dca

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
4f1929f5a0d95ae73abb62736e03d7df

SHA1
5bd26f8551495ef697681dcebb49f57b1a47a7f1

SHA256
ee18da8a45a3de4faac69a0bde3c738e15ad2ad986e84491ac00a6b9f825181f

SHA512
369e2d80981344ed7b06573c42e985d2c107a1c344e29ba4c4c7c48a14d382d2662b7c5a729c2ad98ef314fe1ceb45b28fcf450f854d952620480bc89b18acde

Download Submit
memory/1804-25-0x0000000001F90000-0x0000000001F96000-memory.dmp

Filesize
24KB

Download
memory/3904-8-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download
memory/3904-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3904-0-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download