Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-10-2024 06:37
Static task
static1
Behavioral task
behavioral1
Sample
2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe
Resource
win10v2004-20241007-en
General
-
Target
2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe
-
Size
34KB
-
MD5
cf3ba133a8b6bcb83ae2d8118c25cfa9
-
SHA1
c47325d5e447aaa6e3121d544b8fdb76af1c7fa8
-
SHA256
f6dc0ace42df931cb357623e79ad2353369fa4fd6c6de2d7ea5b4098c950543a
-
SHA512
e4ade634f2ab8d9f8b9a5754f1e1b00a47cad75ade021a97c5e1a6e63978a006fcc3e6a209534893bef7233d8fbbf9aba46e4e638de3fe32d3fced56ac4318cc
-
SSDEEP
384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoi0WlLYZAM9BWpS65:b7o/2n1TCraU6GD1a4X0WlK5gS4
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation 2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe -
Executes dropped EXE 1 IoCs
pid Process 1068 rewok.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rewok.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4252 wrote to memory of 1068 4252 2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe 86 PID 4252 wrote to memory of 1068 4252 2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe 86 PID 4252 wrote to memory of 1068 4252 2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-10_cf3ba133a8b6bcb83ae2d8118c25cfa9_cryptolocker.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4252 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1068
-
Network
-
Remote address:8.8.8.8:53Requestspinistry.comIN AResponsespinistry.comIN A64.98.135.121
-
Remote address:8.8.8.8:53Request68.32.126.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request83.210.23.2.in-addr.arpaIN PTRResponse83.210.23.2.in-addr.arpaIN PTRa2-23-210-83deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request53.210.109.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request171.39.242.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
260 B 5
-
52 B 1
-
59 B 75 B 1 1
DNS Request
spinistry.com
DNS Response
64.98.135.121
-
71 B 157 B 1 1
DNS Request
68.32.126.40.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
83.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
53.210.109.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
171.39.242.20.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
21.236.111.52.in-addr.arpa
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
34KB
MD5572174ea6695f569ce659379152c9909
SHA11273bccf7a6bc4cc139e0ff512d1662950a2d9b6
SHA256ae50e802b16f1c11f382565c81b3ee1a60997a3cf7096c4191059e3228c65fbf
SHA512bd5dd054fd5d568f57e312e06e28a7f697f8ebf1ab1990e1d69187a6e6156210ef11acf23c04be97f982a9ad879389c4204dd981e5df77f45cad26ba8ea30bfb