aeab6e664de66eda4571619a79f054e4242fe2dbed0406f01c72adcc461b7d0b

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
04/02/2024, 01:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-04_451a72ad7670a0db168f304e7ade9c13_cryptolocker.exe
Size

32KB
MD5

451a72ad7670a0db168f304e7ade9c13
SHA1

a50fa531c9929ee50e16ae9c0fbb56a6ad2cd709
SHA256

aeab6e664de66eda4571619a79f054e4242fe2dbed0406f01c72adcc461b7d0b
SHA512

697c4c7dc712801ab800b1ba63266870327526ed0c12bed605dd71d85eb98af9f02948ecabfd978a9955c6f63939e1ae27ecab7701be56ebaea780d6e70e0359
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B1RU3P:b7o/2n1TCraU6GD1a4Xt9bRU/

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000e000000023192-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation	2024-02-04_451a72ad7670a0db168f304e7ade9c13_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4276	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3656 wrote to memory of 4276	3656	2024-02-04_451a72ad7670a0db168f304e7ade9c13_cryptolocker.exe	85
PID 3656 wrote to memory of 4276	3656	2024-02-04_451a72ad7670a0db168f304e7ade9c13_cryptolocker.exe	85
PID 3656 wrote to memory of 4276	3656	2024-02-04_451a72ad7670a0db168f304e7ade9c13_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-02-04_451a72ad7670a0db168f304e7ade9c13_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-04_451a72ad7670a0db168f304e7ade9c13_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3656
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:4276

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
32KB

MD5
559f3cedd070d3d4d43062395be49494

SHA1
3fdbde1b84d0b17e28733ceb568724dbe9e88cc3

SHA256
222dfd2c2373528ee20356ef33205f100b68f676a59f2c0e32438c41c2bca77c

SHA512
b137f2c1e54911d6bd285d8129f910e7a41eb8e1e22863c01c5aa334d3cd1b49470467800c60ff2779dfd680985f9e2f8ab9003a3089bbeb18fc5376744b17a1

Download Submit
memory/3656-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/3656-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/3656-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4276-21-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download