a83d33eba2d7bbe2d7bf434bd24444c1f22802bbf7b0c5ea34cd175b951cd165

Analysis

max time kernel
148s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 06:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-08_8e5498c7c51dff2201a5284eaa0eeff4_cryptolocker.exe
Size

46KB
MD5

8e5498c7c51dff2201a5284eaa0eeff4
SHA1

f5e203b78fa0c437ed31789bcddd8a28fd665e06
SHA256

a83d33eba2d7bbe2d7bf434bd24444c1f22802bbf7b0c5ea34cd175b951cd165
SHA512

3d0071966b4ad316f95f7a693856a4b1546fcd8b45f444983a7e69b525d2f6fb491bac0028119a4d797002dd147488a5234a7d4c3df8ea022fcb8d116c6444e1
SSDEEP

768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zH:bF/y2lFizbR9XwzH

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\Control Panel\International\Geo\Nation	2024-09-08_8e5498c7c51dff2201a5284eaa0eeff4_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1136	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-08_8e5498c7c51dff2201a5284eaa0eeff4_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rewok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2700 wrote to memory of 1136	2700	2024-09-08_8e5498c7c51dff2201a5284eaa0eeff4_cryptolocker.exe	84
PID 2700 wrote to memory of 1136	2700	2024-09-08_8e5498c7c51dff2201a5284eaa0eeff4_cryptolocker.exe	84
PID 2700 wrote to memory of 1136	2700	2024-09-08_8e5498c7c51dff2201a5284eaa0eeff4_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-09-08_8e5498c7c51dff2201a5284eaa0eeff4_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-08_8e5498c7c51dff2201a5284eaa0eeff4_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1136

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
46KB

MD5
e09c733ae199c8d91e6c46a6240fe9a6

SHA1
deac8878afc57c0dc742d040f78970f926368aaf

SHA256
ee5edfa5070ee05d31aebb3870d7bc8829294cba17222ef9cde91b5466602bd4

SHA512
f57617036739ebb2838a2a2ff50f96fa7eba257d7c79f8313a9832797cbc041f9a36bc927428758acff1a5eacf8e1dff54d3a76b3526edb79f61c2e0b5cf2ac2

Download Submit
memory/1136-25-0x0000000002020000-0x0000000002026000-memory.dmp

Filesize
24KB

Download
memory/2700-0-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2700-1-0x0000000000520000-0x0000000000526000-memory.dmp

Filesize
24KB

Download
memory/2700-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download