25b3b45f1676939bcacfcfd2ca7bdc6d3de0a3f4f0fa74fe709281fda048d025

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 04:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_7e55d18d8b638bd87fc36982f9ff2862_cryptolocker.exe
Size

36KB
MD5

7e55d18d8b638bd87fc36982f9ff2862
SHA1

09f8e9f7d6c17b97a18381137ce49c1bb5dc6113
SHA256

25b3b45f1676939bcacfcfd2ca7bdc6d3de0a3f4f0fa74fe709281fda048d025
SHA512

9e6a3e932be0f87bb8daa364694e92fb654a84e963049d82683715621c068db837e54f5ab7c2bced0cbeaa77cf254acf73e68e7700e745ae6a4af7a976b0d872
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B1RU3qE4kb6oY26zT:b7o/2n1TCraU6GD1a4Xt9bRU6zA6o36v

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e97c-11.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	2024-04-22_7e55d18d8b638bd87fc36982f9ff2862_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3192	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 3192	1532	2024-04-22_7e55d18d8b638bd87fc36982f9ff2862_cryptolocker.exe	85
PID 1532 wrote to memory of 3192	1532	2024-04-22_7e55d18d8b638bd87fc36982f9ff2862_cryptolocker.exe	85
PID 1532 wrote to memory of 3192	1532	2024-04-22_7e55d18d8b638bd87fc36982f9ff2862_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-04-22_7e55d18d8b638bd87fc36982f9ff2862_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_7e55d18d8b638bd87fc36982f9ff2862_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:3192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
37KB

MD5
7e4e0d497fb674f7b6b8ee1f5dd3db06

SHA1
124465c5c4f587986954959ed813ee93dee30b7a

SHA256
18422a18d8ae43a9f8b7ec292af7bdd68db01d0d9da3f674a993ea2cad30e5ed

SHA512
9d2db341b97042e6cd4ad2b1f541a23cf2488b17d510e08fb244b56082920150438b95c1168939ecbcdf907f485bf9052fea57eeca6f0f5ef26f3c8365706be1

Download Submit
memory/1532-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1532-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/1532-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3192-21-0x0000000002160000-0x0000000002166000-memory.dmp

Filesize
24KB

Download