0a243f914b36cacdb2d3fc0997de19c570ab0255f33c4b9887fccd4c63721fd2

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe
Size

33KB
MD5

ddc9d26df6f3f368dc6ad7f0d3e47798
SHA1

448d770d3e7113a4fccdc037c6788340080517b4
SHA256

0a243f914b36cacdb2d3fc0997de19c570ab0255f33c4b9887fccd4c63721fd2
SHA512

f19018296c30b1ea9d5eb40d8477098b9bf24c8f53c7b0bddc0f707c9f79a49d3217a7eaef9c7dbc392d1a310b1d8e1c39f6bc947cf37659c27fd904176c1061
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B4lWS+M:btB9g/WItCSsAGjX7r3B4GM

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2272	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2876	2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2876	2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe
2272	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2272	2876	2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe	29
PID 2876 wrote to memory of 2272	2876	2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe	29
PID 2876 wrote to memory of 2272	2876	2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe	29
PID 2876 wrote to memory of 2272	2876	2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe	29

C:\Users\Admin\AppData\Local\Temp\2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-05_ddc9d26df6f3f368dc6ad7f0d3e47798_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
33KB

MD5
c419588c93a2bf4a764316ce812a5705

SHA1
0425da35c858ce7b452c56977e4024d778773e61

SHA256
79024b9a12ed7046b006117f498b037068e9036809f8051222d619db0e6ad69e

SHA512
a446f5e38785a914fc2d9bc4fe42bd755fb7f7d4407570245afd4f7d7f56b878e6ec1e6c3251b59550f2b55e3edea6d9e4d4644ec31585e7a0e8ca6d474bf703

Download Submit
memory/2272-23-0x00000000007E0000-0x00000000007E6000-memory.dmp

Filesize
24KB

Download
memory/2876-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2876-0-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download
memory/2876-8-0x0000000000210000-0x0000000000216000-memory.dmp

Filesize
24KB

Download