cd6bb2ab21ddf83bc9282f164b8cba6b8c8a11e682809cb570ddf3f2bbbd56ed

Analysis

max time kernel
148s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe
Size

44KB
MD5

697a58f2ce91efa3494faceaf80cbad1
SHA1

909dd250e73c62dbcb3f4b5738fc57bddc6c7eea
SHA256

cd6bb2ab21ddf83bc9282f164b8cba6b8c8a11e682809cb570ddf3f2bbbd56ed
SHA512

94b5ac4dfb5c0a7977bff859b9e73fd48c9b6d8315693c7ec57a3eebc40406e0fa26810cef3d4b9813a4509a1fa7723c775f4254ae75191c3464156b62305c56
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMphqD:bc/y2lkF0+BeqD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023263-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3596	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4028 wrote to memory of 3596	4028	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe	91
PID 4028 wrote to memory of 3596	4028	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe	91
PID 4028 wrote to memory of 3596	4028	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4028
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:8
1⤵
PID:1644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
44KB

MD5
03f013ac3367ff0f0b7ba072b51c71ee

SHA1
5b2cec4dac857e7f915cfbcb6781d54b7110162f

SHA256
d2c7038b806c2ce6708c1fa5d206ae752de1baccaf28d0060d3fb24fa64c4136

SHA512
daf28620b2acb1138354ad279e4a997b26ab183e5d313bb8da2f7a34abc972ed659c092c9adf196159995c39b9ea85eff74e9d68c9e6fe5efe9c2011fc93a557

Download Submit
memory/3596-24-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/4028-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4028-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4028-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download