ae32bfe3014958971405d15a751745bbbd5fe75e6935992fa4cbdd620d863fc3

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18/10/2024, 02:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe
Size

64KB
MD5

26c6e0b90ab78630162ae4e1b780cc4b
SHA1

93e0f5eb43b766657714c243cda08514f77253c5
SHA256

ae32bfe3014958971405d15a751745bbbd5fe75e6935992fa4cbdd620d863fc3
SHA512

0a5fe845e2afefc34fdd22992c02593d0389536436ddadc1bb63724af217ded3d6aa77688b9b4c5f8fb0239ff329c60a462a18356b5ed748e9f3cca0e503a5b6
SSDEEP

1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnT5Q:btng54SMLr+/AO/kIhfoKMHdaO

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2904	gewos.exe

Loads dropped DLL 1 IoCs

pid	Process
2888	2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2888	2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe
2904	gewos.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2904	2888	2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe	30
PID 2888 wrote to memory of 2904	2888	2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe	30
PID 2888 wrote to memory of 2904	2888	2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe	30
PID 2888 wrote to memory of 2904	2888	2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-18_26c6e0b90ab78630162ae4e1b780cc4b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
65KB

MD5
ff5cf85407a4e83796f7634d93b6aa04

SHA1
314891372c291a564359f5ac685ec2a994538b01

SHA256
79f09e2556a292fecc6651602d7247f4c8727fd01ad5aa51e627d6a81ae71baa

SHA512
91378d4000dadc786662bc2a0e4f7bc31827acfbd55780672af0810101d491249ae4da33a9b49db3c2fe0fbec6a7a4007ee38c65562c78503f7c9695002c76c1

Download Submit
memory/2888-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2888-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2888-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2904-23-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download