eef905ae98a6791de6bbef7f9a7fdddfd53c6c9c4e9186c66009cd9c9ce50fa4

Analysis

max time kernel
147s
max time network
148s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-10-2024 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe
Size

36KB
MD5

2fbc1b2faef038ad3e7917a65f2bc2c3
SHA1

0b885b35e4cba6761e93ff3a832b9c3fc632fde8
SHA256

eef905ae98a6791de6bbef7f9a7fdddfd53c6c9c4e9186c66009cd9c9ce50fa4
SHA512

8a7b71781eedadc622127830c0efe318a754c1490b848af631038d3f0fd24c071a049ebbdbd047ac7d09846f4cbdbdd8e917674005564aa9d281b8c9f9a27fb5
SSDEEP

384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B94IOMHo3sxP1HO:btB9g/WItCSsAGjX7r3BPOMHocM4v+j

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2776	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2636	2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2636	2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe
2776	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 2776	2636	2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe	30
PID 2636 wrote to memory of 2776	2636	2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe	30
PID 2636 wrote to memory of 2776	2636	2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe	30
PID 2636 wrote to memory of 2776	2636	2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-13_2fbc1b2faef038ad3e7917a65f2bc2c3_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
37KB

MD5
803a955077010eff810839ea510bc596

SHA1
7675abc9a5ffd16da0fd01c9a3e7b48356294071

SHA256
47a988222d7b07f5e3a61094ab4981558a4f5e95a4398d3976e8a2d8ccf1e8c1

SHA512
d1e782576579df6ceb0b3210da92e52a5b4cf299bed2e75a48180bcb414d577a623024b8249e5ae9af66105bf7e4acbbe6e4a9e54fb3989d4a5c27588767e20b

Download Submit
memory/2636-0-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2636-8-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2636-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download