a2ac79e02b7babdfc8ee686d2f794f4db2b975e5aaa4fe7f4efbdad8fa0f8bd0

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 06:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-07_59cf09af4d83c943fb298d711e093767_cryptolocker.exe
Size

46KB
MD5

59cf09af4d83c943fb298d711e093767
SHA1

b8e0693cf58682acd4591783e1caafaaa7231fe1
SHA256

a2ac79e02b7babdfc8ee686d2f794f4db2b975e5aaa4fe7f4efbdad8fa0f8bd0
SHA512

ee352517699c47fb438190ae244b11fe5e45e3e0e906d8eebd8c44b3e0ea4bd98107ff83f75c2460dca31d3519621a5f21c389afb070b7a251bba16e039df679
SSDEEP

768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zO:bF/y2lFizbR9XwzO

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	2024-09-07_59cf09af4d83c943fb298d711e093767_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
4056	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-07_59cf09af4d83c943fb298d711e093767_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rewok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 4056	1076	2024-09-07_59cf09af4d83c943fb298d711e093767_cryptolocker.exe	85
PID 1076 wrote to memory of 4056	1076	2024-09-07_59cf09af4d83c943fb298d711e093767_cryptolocker.exe	85
PID 1076 wrote to memory of 4056	1076	2024-09-07_59cf09af4d83c943fb298d711e093767_cryptolocker.exe	85

C:\Users\Admin\AppData\Local\Temp\2024-09-07_59cf09af4d83c943fb298d711e093767_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-07_59cf09af4d83c943fb298d711e093767_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
46KB

MD5
1e84b17247bb54f7543828a63d348f08

SHA1
488afd20a9146729e0a3568fb7214287e126327e

SHA256
5bb67e8e358b50f5d1f797aa17d23f24fdf08906c85bc8a0c9b1edaad88da571

SHA512
a74682c67690be22ba1672734d4cebe49c700de8209df4eff907a50c944d897cf7e074644cac1799c3e800ce08b91013fb5c64795f0a17114661a68f1388f0e4

Download Submit
memory/1076-0-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/1076-1-0x0000000002E90000-0x0000000002E96000-memory.dmp

Filesize
24KB

Download
memory/1076-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4056-25-0x0000000002080000-0x0000000002086000-memory.dmp

Filesize
24KB

Download