68d81299e08d8dab4da9b1fbec55b10d5bf8b3343cdb4dd0ee4dd0e408141f28

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30-05-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-30_c58f472d69babf2648b2b4603d53214f_cryptolocker.exe
Size

38KB
MD5

c58f472d69babf2648b2b4603d53214f
SHA1

bf51dcc0c67368e74288663ec5076f7a14cfc5ab
SHA256

68d81299e08d8dab4da9b1fbec55b10d5bf8b3343cdb4dd0ee4dd0e408141f28
SHA512

31d969712210f95e0fb34379774aa62a1799e02004cb4f0fb94cec8bbc0f0866724f71bbad295833d547ac8594994bf82c22cde44dbf4217df2543d3631def9b
SSDEEP

768:b7o/2n1TCraU6GD1a4Xt9bRU6zA6o36mhT:bc/y2lLRU6zA6q1

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000a000000023419-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	2024-05-30_c58f472d69babf2648b2b4603d53214f_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3328	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 3328	3952	2024-05-30_c58f472d69babf2648b2b4603d53214f_cryptolocker.exe	84
PID 3952 wrote to memory of 3328	3952	2024-05-30_c58f472d69babf2648b2b4603d53214f_cryptolocker.exe	84
PID 3952 wrote to memory of 3328	3952	2024-05-30_c58f472d69babf2648b2b4603d53214f_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-05-30_c58f472d69babf2648b2b4603d53214f_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-30_c58f472d69babf2648b2b4603d53214f_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
39KB

MD5
745349870235b45d8f48066e15d8bd25

SHA1
0398e1c46d7b628ddfadfa56fcfe1ada0c1ca2ad

SHA256
778518f1b1e6e346c2eae49586624e04a3df0dd2ad1666ba2626d752018eb61a

SHA512
ea9f43eeedade6c22e2688cb1cb65750ffd9944ff7df5357516f2e9339a7a55045a6ac7a7003ad133ec969a3fae7c6838babf3bcb2858180036f02e4e8513d2b

Download Submit
memory/3328-25-0x0000000002010000-0x0000000002016000-memory.dmp

Filesize
24KB

Download
memory/3952-0-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/3952-8-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/3952-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download