580d3cc6987ca1870d43467295e6b44c80b8a76d50ee409c7732f315d7ec39ce

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe
Size

54KB
MD5

6b1ec2a4c21ec017749f93cece471526
SHA1

84feb321593d200db662d6fdc116e5657738677b
SHA256

580d3cc6987ca1870d43467295e6b44c80b8a76d50ee409c7732f315d7ec39ce
SHA512

3545da3742d71cd0a0448a2a58aed36d25c4a134ef1688e6a169b89c0c821bb114b8ee6deb80fb01ee1a46deb0dc31d1310d220b558c5882ee592c7fefccaacc
SSDEEP

768:b7o/2n1TCraU6GD1a4Xcn62tH/1/Lp17zJIfeVEuUr6q:bc/y2lm6iH/NLp17zrV9Y

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023288-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4772	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 4772	2388	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe	83
PID 2388 wrote to memory of 4772	2388	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe	83
PID 2388 wrote to memory of 4772	2388	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe	83

C:\Users\Admin\AppData\Local\Temp\2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:4772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
54KB

MD5
f5591bf965a2f1eff6895317823b639b

SHA1
dabe581e4ce7fd75b936bb9633d79ce840b9a63b

SHA256
21da3cd4ad996250353fb6fabf2baff0fecc12e6866d4581bc6a462efa67c788

SHA512
0c380018ec46fb168a8c98d5dfb358c81480ee3eda7b2077120972a554e497016ebe55e8e3f3d13e1778b6e8e0ca20e3f914063b05ecaabc8f374feee5bee207

Download Submit
memory/2388-0-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/2388-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2388-8-0x0000000000730000-0x0000000000736000-memory.dmp

Filesize
24KB

Download
memory/4772-25-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download