2eae8abc62304177fbe37390a7b58f37f8672b31a2f5f0bb25c0928e68a08e54

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
28-01-2024 05:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_07bf39ddbd12db87d4ca6271600e8ed8_cryptolocker.exe
Size

31KB
MD5

07bf39ddbd12db87d4ca6271600e8ed8
SHA1

99662bc69819f5aa581bbd6d045e1e996c260111
SHA256

2eae8abc62304177fbe37390a7b58f37f8672b31a2f5f0bb25c0928e68a08e54
SHA512

a067144e3ee5cadf1817586b29a7bf0d49c8c0473adcf793795d8e88db0a7382c3f1c07c80429ba367a64672b84e3bf32eab5df4fce3cebdf685f6faf8556af4
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B+m:b7o/2n1TCraU6GD1a4Xt9h

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f9-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation	2024-01-28_07bf39ddbd12db87d4ca6271600e8ed8_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3940	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3940	4972	2024-01-28_07bf39ddbd12db87d4ca6271600e8ed8_cryptolocker.exe	86
PID 4972 wrote to memory of 3940	4972	2024-01-28_07bf39ddbd12db87d4ca6271600e8ed8_cryptolocker.exe	86
PID 4972 wrote to memory of 3940	4972	2024-01-28_07bf39ddbd12db87d4ca6271600e8ed8_cryptolocker.exe	86

C:\Users\Admin\AppData\Local\Temp\2024-01-28_07bf39ddbd12db87d4ca6271600e8ed8_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_07bf39ddbd12db87d4ca6271600e8ed8_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
31KB

MD5
4038eb05801aba2e06d331d0f12eb77e

SHA1
3d2c6667298c44b7e34929bfb429bf1257c16908

SHA256
61eba8ae7acb2232ef0d7a969b3e6f9994b84df76cabe2e24dc79252328a0a05

SHA512
28a8dca419873a3a5e86a25f65a626bf8ea5ee98065c263532bbbf455cf4b8f95e75c0e5a33f205503270acbd1f876f4a6b991e37e49f55734b7dab211c7a4b0

Download Submit
memory/3940-20-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/4972-0-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/4972-1-0x0000000002180000-0x0000000002186000-memory.dmp

Filesize
24KB

Download
memory/4972-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download