ec283e7f58db98f6287fdf61e4cf65650540a917415aa88e63a3405cded81501

Analysis

max time kernel
106s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2025, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-21_cb1ff66299d8cea4d00c14fabd73c657_cryptolocker.exe
Size

25KB
MD5

cb1ff66299d8cea4d00c14fabd73c657
SHA1

c074d6f60cc419466daed6d4cdc017063f31c008
SHA256

ec283e7f58db98f6287fdf61e4cf65650540a917415aa88e63a3405cded81501
SHA512

82e4fd178a8a0cfcbf66656898c5bb1cefff11433224427ea911daa9e6882a72ec335fca55d5b10ede0b6be92b2756d9548f48eb5e088fe36b9ea976ee3f8831
SSDEEP

384:2pzt9rFQeKoOz/IHKhJfV8WcU+9Qi/zz47WmeXqA:2pz3hPKFzwHgJ9H/+VXRJ

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	2025-03-21_cb1ff66299d8cea4d00c14fabd73c657_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-814918696-1585701690-3140955116-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
3288	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-21_cb1ff66299d8cea4d00c14fabd73c657_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5212 wrote to memory of 3288	5212	2025-03-21_cb1ff66299d8cea4d00c14fabd73c657_cryptolocker.exe	87
PID 5212 wrote to memory of 3288	5212	2025-03-21_cb1ff66299d8cea4d00c14fabd73c657_cryptolocker.exe	87
PID 5212 wrote to memory of 3288	5212	2025-03-21_cb1ff66299d8cea4d00c14fabd73c657_cryptolocker.exe	87

C:\Users\Admin\AppData\Local\Temp\2025-03-21_cb1ff66299d8cea4d00c14fabd73c657_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-21_cb1ff66299d8cea4d00c14fabd73c657_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5212
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
25KB

MD5
f4c1f243c6af00b19fcd584a9306eae0

SHA1
ad3fd810ad4ec20bf9f540f8313131634fdd6063

SHA256
f61a22fefad6e2afa381b0983196aa2f6a69e09e62b2fcd2074701c63fe552c1

SHA512
801a63764a228240fbd54435d6ff0ba941db53c1958ce87347fe65e3da023728e6763a2c0d34a9385afa5ef4ac604c82ccfc7915ac5a0ed1be571c9167ac5d6d

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
935962a0508b4a025733a3afdf493222

SHA1
06ba8b7dacc4a4981abc556b56b2ae5f3fcf8d70

SHA256
427216da2b1241f91a029e04ba916b34d967158ecd2f7cd6a78fdf61207b5282

SHA512
1d7fef6377f66348bfbe0903bcdb0abd129a6cdd41bab2d54d3ba7b52b4377df002ce99a42fc4cbc9e55d8576e06a2797b8f2580cf13665d4e917877c59bb49e

Download Submit
memory/3288-17-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/3288-26-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download
memory/5212-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/5212-1-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/5212-2-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/5212-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download