44ef1ca6a81f096fa49f225c3ecf04b99a0e1949a28850cc2607acfd8d44a448

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2023, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe
Size

39KB
MD5

393311f76f83cd894c7038e61f214f7b
SHA1

c4b7e3cff7e8fa982fbb3721cefced16c2b59265
SHA256

44ef1ca6a81f096fa49f225c3ecf04b99a0e1949a28850cc2607acfd8d44a448
SHA512

3c21abcbfb6cca337ebddf7ce64ddf052813fe9f415a6181f077f4e6a95a2ed8e52c547be54f74ffd28a8db8c3de5f488f345d3efd63e6a17f0c46e8082ffcca
SSDEEP

768:b7o/2n1TCraU6GD1a4Xcn62TUdcuQlqJ51mwV:bc/y2lm6Y0AqJ51mwV

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-568313063-1441237985-1542345083-1000\Control Panel\International\Geo\Nation	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
2108	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 2108	4932	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe	85
PID 4932 wrote to memory of 2108	4932	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe	85
PID 4932 wrote to memory of 2108	4932	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe	85

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:2108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
40KB

MD5
795b19787fd72c9a9d7ceacbe476b57f

SHA1
aea617a73a6deb6d223289b69dd014791a93c7cd

SHA256
c217a0af307de9cb12741ee155e631ca0d20dc66a40b2f47e8ccfd96a3bcab30

SHA512
283ecdd34f99b5582aa6e00330b7dfca0de66573d089ce00541d3726d86269305f72ed6f313338c28e340a1a92d3fc94cc389d8f465f22853f556e0886563907

Download Submit
C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
40KB

MD5
795b19787fd72c9a9d7ceacbe476b57f

SHA1
aea617a73a6deb6d223289b69dd014791a93c7cd

SHA256
c217a0af307de9cb12741ee155e631ca0d20dc66a40b2f47e8ccfd96a3bcab30

SHA512
283ecdd34f99b5582aa6e00330b7dfca0de66573d089ce00541d3726d86269305f72ed6f313338c28e340a1a92d3fc94cc389d8f465f22853f556e0886563907

Download Submit
C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
40KB

MD5
795b19787fd72c9a9d7ceacbe476b57f

SHA1
aea617a73a6deb6d223289b69dd014791a93c7cd

SHA256
c217a0af307de9cb12741ee155e631ca0d20dc66a40b2f47e8ccfd96a3bcab30

SHA512
283ecdd34f99b5582aa6e00330b7dfca0de66573d089ce00541d3726d86269305f72ed6f313338c28e340a1a92d3fc94cc389d8f465f22853f556e0886563907

Download Submit
memory/2108-19-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/4932-0-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/4932-1-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download
memory/4932-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download