6e9aa15ab94d40d2d80b1703b8cbd10cb8986d540788f6d5747dfd44ed54008a

Analysis

max time kernel
104s
max time network
125s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2025, 08:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-21_d4b8a54c0d94af3de3d658677949cbdd_cryptolocker.exe
Size

61KB
MD5

d4b8a54c0d94af3de3d658677949cbdd
SHA1

ec0a277fe004f66ede4f57f7fa5d880f01a0b5a9
SHA256

6e9aa15ab94d40d2d80b1703b8cbd10cb8986d540788f6d5747dfd44ed54008a
SHA512

d7d79c1e26be3d7ba2bbb051ca152a36fbec62d5193dda22e3747b3563ee9d2b79960708723d9071a227766e755ab2be5172e6bf9140c2e5f09dd1b074d9b625
SSDEEP

768:bYv9g/WItCSsAGmXWhaI9cZnIe9N0hunrknljKrCY19:bYv9g/xtCSDx6A7f1rksrx19

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	2025-03-21_d4b8a54c0d94af3de3d658677949cbdd_cryptolocker.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3920955164-3782810283-1225622749-1000\Control Panel\International\Geo\Nation	gewos.exe

Executes dropped EXE 1 IoCs

pid	Process
4460	gewos.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-21_d4b8a54c0d94af3de3d658677949cbdd_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	gewos.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 4460	4060	2025-03-21_d4b8a54c0d94af3de3d658677949cbdd_cryptolocker.exe	88
PID 4060 wrote to memory of 4460	4060	2025-03-21_d4b8a54c0d94af3de3d658677949cbdd_cryptolocker.exe	88
PID 4060 wrote to memory of 4460	4060	2025-03-21_d4b8a54c0d94af3de3d658677949cbdd_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2025-03-21_d4b8a54c0d94af3de3d658677949cbdd_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-21_d4b8a54c0d94af3de3d658677949cbdd_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Users\Admin\AppData\Local\Temp\gewos.exe
  "C:\Users\Admin\AppData\Local\Temp\gewos.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\gewos.exe

Filesize
61KB

MD5
10e3ddff0e8aad30722d8efe63a3ae12

SHA1
79588b76034c6f7ffa8185f5aebefa22ca4c1292

SHA256
74ce8d70205bf057082c699ba4eba6bdb7e97b8c1a10f6a590d3b69c599731e1

SHA512
9eda31bf771a11f35c043aae54544472358f4dc8c1349008b3bb721b6714f8b3e8502066394c8cd9fcdd9dc36462002c65091d53acfa0ffb4e5e1720935ce406

Download Submit
C:\Users\Admin\AppData\Local\Temp\gewosik.exe

Filesize
185B

MD5
4dc853799b46b41333aff0f2f2db8c9b

SHA1
0082d422fd999fba06ef3c1c7fc71495d29d260b

SHA256
7cf5e1211f5396daad9c2353f52e6f614d7b6741981b48451a007fb488c966f7

SHA512
5bc17b92d622f317bd2e3dacc509f9415bf1355e763f4ebb98835fc0bbeb823925d65b99c9b235fd199c38dcbcd10e30fff77075b28bd1c07918b61a83a2875d

Download Submit
memory/4060-0-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/4060-1-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/4060-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4460-19-0x00000000021D0000-0x00000000021D6000-memory.dmp

Filesize
24KB

Download