6e332f8bb0f000efaa4e1457f1110ded56aaa62612b8e3a861d9df09984f0cf2

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe
Size

38KB
MD5

6c16e676aee60e8c9a1608b062560ec9
SHA1

84681fee16d54f8619bf8e75f82f0bb607a2c5d2
SHA256

6e332f8bb0f000efaa4e1457f1110ded56aaa62612b8e3a861d9df09984f0cf2
SHA512

3dbb744484c6aa3f5ec1efc95275e9901de2d58b015d3cd44927d79970573f872add2a94866328b87d8a8817b6b32c6b741500fde1abbd6d20623df8271e5ca9
SSDEEP

768:b7o/2n1TCraU6GD1a4Xt9bRU6zA6o36m8:bc/y2lLRU6zA6q8

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\rewok.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation	2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

rewok.exe

pid process

2868 rewok.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2868	rewok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe

description	pid	process	target process
PID 4224 wrote to memory of 2868	4224	2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe	rewok.exe
PID 4224 wrote to memory of 2868	4224	2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe	rewok.exe
PID 4224 wrote to memory of 2868	4224	2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe	rewok.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_6c16e676aee60e8c9a1608b062560ec9_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4224

C:\Users\Admin\AppData\Local\Temp\rewok.exe
"C:\Users\Admin\AppData\Local\Temp\rewok.exe"
2⤵
- Executes dropped EXE
PID:2868

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe
Filesize
38KB

MD5
1ed43e86aea800acefc65bba619d1e5d

SHA1
23e2ec0da75cfe1687d553936e3ce2c786436ba4

SHA256
e4343f19fd68227eec0415840a0ad82b9964bfb1da820940cfc092e5ab719a7b

SHA512
394a7bf23d5b78b9dd18d3a823a1fa09ab52db9526fb125a8fe6a682f5e1c7275a9b70a2777a90cff11437fb3591d5da776b08d84675e82b2d8caebdca40c731

Download Submit
memory/2868-25-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/4224-0-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/4224-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4224-8-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download