67a57ff0e2d91bacc1d97bb2dce894d997d09b31601d244531244bffb7116468

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
02-11-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe
Size

59KB
MD5

041af916ed0edcca84cd67c51722c654
SHA1

394775060826f73006857fcfb5efd5e81dd3c539
SHA256

67a57ff0e2d91bacc1d97bb2dce894d997d09b31601d244531244bffb7116468
SHA512

412ce15565c8932670710b12ad7969703e6f25d7a7c57d2112590ffa81ee2deee460b1b6311e586165db7193864cfa917b56a4fe3b9878cdecb9bb196cd19fc1
SSDEEP

768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjlgcSW:bP9g/xtCS3Dxx0S

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

gewos.exe

pid process

3860 gewos.exe

pid	process
3860	gewos.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/4536-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\gewos.exe	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exegewos.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe

description	pid	process	target process
PID 4536 wrote to memory of 3860	4536	2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe	gewos.exe
PID 4536 wrote to memory of 3860	4536	2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe	gewos.exe
PID 4536 wrote to memory of 3860	4536	2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe	gewos.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-02_041af916ed0edcca84cd67c51722c654_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4536

C:\Users\Admin\AppData\Local\Temp\gewos.exe
"C:\Users\Admin\AppData\Local\Temp\gewos.exe"
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
59KB

MD5
5895d89e51259116085440051921f04d

SHA1
51bd9b877cd8a63e0c2055aac6d4229bfd24a1fb

SHA256
4902c9a6ec8460ead640def06d9eba4a3bcf6aacbb089ff35a0c8b3015efb79a

SHA512
144afe4fa09d5639b2db0ef57ba8bd41bd9f324143b75637b4bca81ff82792826883c68afbf27cf6589ddd15ed09a287b6bb0f1cadda3ab70ec21e04c0e15d65

Download Submit
memory/3860-20-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/4536-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4536-1-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4536-2-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4536-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download