1de90d5e4c6c3c6ed25dbfac8864097800e8d4c7d6971e2eade35336170ed259

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-11-2024 07:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe
Size

55KB
MD5

553b9ebc3c02b29d05a807c42f5f7223
SHA1

514732f17b62fefb639e5ec73626ff72789e9366
SHA256

1de90d5e4c6c3c6ed25dbfac8864097800e8d4c7d6971e2eade35336170ed259
SHA512

fe6d98dc0c5f36dcc84484102317ae30e9cc8c20a4c4522970e30944eeb10151d9a325ea57d85ae1088c5dd76edbdad70d034c54af22ec030ddf7257d9af1ccf
SSDEEP

768:bco/2n1TCraU6GD1P2wZEjbhxnbcuyD7U9kXDn62tH/1/LpPFPw:b7/y28wZEjbnouy8G76iH/NLpm

Score

7^/10

discovery upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3350944739-639801879-157714471-1000\Control Panel\International\Geo\Nation	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

rewok.exe

pid process

1868 rewok.exe

pid	process
1868	rewok.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/3524-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
C:\Users\Admin\AppData\Local\Temp\rewok.exe	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exerewok.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rewok.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe

description	pid	process	target process
PID 3524 wrote to memory of 1868	3524	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe	rewok.exe
PID 3524 wrote to memory of 1868	3524	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe	rewok.exe
PID 3524 wrote to memory of 1868	3524	2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe	rewok.exe

C:\Users\Admin\AppData\Local\Temp\2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-11-21_553b9ebc3c02b29d05a807c42f5f7223_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3524
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
55KB

MD5
ba4f46e7032a0f2ba298e0fa11c9cf17

SHA1
3a8e99bebbae0557094e1dd9c83239b0df3329c1

SHA256
97512ef97e8b1694ed5658328e010541782f31dafb1c51a1e4ab4bbd1758266d

SHA512
08a2bbcd985650d5e9cf3857ed33df67a6148cf2532fbe2d45f77fb5711b4564762c92a45708dedd769e59414fc18263446479c09ae1ff54e116d6de869fd42c

Download Submit
memory/1868-26-0x0000000000680000-0x0000000000686000-memory.dmp

Filesize
24KB

Download
memory/3524-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3524-1-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/3524-2-0x0000000002120000-0x0000000002126000-memory.dmp

Filesize
24KB

Download
memory/3524-3-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download