1f46a896146fb89171fb50f878cc273ce29b8429321174c199ece403ca168d12

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-09-19_4b53c1c77f063eda00d8df042a5171b0_cryptolocker.exe
Size

54KB
MD5

4b53c1c77f063eda00d8df042a5171b0
SHA1

7cf86f34042513da6be8877f1b69b69fac67390d
SHA256

1f46a896146fb89171fb50f878cc273ce29b8429321174c199ece403ca168d12
SHA512

2c82a1b53c463ef9f5ec1af6f397a5263b0528b25d5e4b3b1f3164a520cd2783decc18c71b594a5c6dfa3db25e0f53db56e69bda6c6f010bdd15e50b0f1b5f10
SSDEEP

768:bco/2n1TCraU6GD1P2wZEjbhxnbcuyD7U9kXDn62tH/1/LpPFP7:b7/y28wZEjbnouy8G76iH/NLpx

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	2024-09-19_4b53c1c77f063eda00d8df042a5171b0_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1916	rewok.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4020-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral2/files/0x000900000002362a-13.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-19_4b53c1c77f063eda00d8df042a5171b0_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rewok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 1916	4020	2024-09-19_4b53c1c77f063eda00d8df042a5171b0_cryptolocker.exe	89
PID 4020 wrote to memory of 1916	4020	2024-09-19_4b53c1c77f063eda00d8df042a5171b0_cryptolocker.exe	89
PID 4020 wrote to memory of 1916	4020	2024-09-19_4b53c1c77f063eda00d8df042a5171b0_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-09-19_4b53c1c77f063eda00d8df042a5171b0_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-19_4b53c1c77f063eda00d8df042a5171b0_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4216,i,16316361669272684588,6171287487746154806,262144 --variations-seed-version --mojo-platform-channel-handle=4076 /prefetch:8
1⤵
PID:2260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
54KB

MD5
cd766a3f10d1fbcf4feaaec03081f7b8

SHA1
36d912532d3b29b11fff40ef00e68b563a8839b9

SHA256
a50e665dc4389dad3483eaf24f77aca20b1d3bb085ac4e545219d7c073e646a9

SHA512
4f2c50f4b81d15917d3cce67f8265684a577a8c05d4dbe80c1eb0d482e175b938264fd08cfa1fd9c70450da00de6402a0a7ee63fb36bed9f9c4c2fed5047c3e5

Download Submit
memory/1916-20-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download
memory/4020-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/4020-1-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/4020-2-0x00000000006F0000-0x00000000006F6000-memory.dmp

Filesize
24KB

Download
memory/4020-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download