b55cad056ff5b16e209503b71d83d9fb52b3ac8496ec5296ea80b01dccd31c15

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
21/03/2025, 08:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2025-03-21_05bba76e4016e739e90adc510f56cfee_cryptolocker.exe
Size

81KB
MD5

05bba76e4016e739e90adc510f56cfee
SHA1

e085e4df26c00cd4cdbb53e3a4860bb63c4daac9
SHA256

b55cad056ff5b16e209503b71d83d9fb52b3ac8496ec5296ea80b01dccd31c15
SHA512

270cb0fa101eae6c3860da7c32c06470ca068e5f95f3d6567a99aaa7760160f049d0603d14300c078fe6e90959bd8f071e45269703c1853f98c75e17dfb003d0
SSDEEP

1536:bG/y2lmBnzzLx0F0+B2taDfNjHft0HJd1iJ:bGarBnzzLxLt6VjHf2HJd1+

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-869607583-2483572573-2297019986-1000\Control Panel\International\Geo\Nation	2025-03-21_05bba76e4016e739e90adc510f56cfee_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
376	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2025-03-21_05bba76e4016e739e90adc510f56cfee_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rewok.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 376	4456	2025-03-21_05bba76e4016e739e90adc510f56cfee_cryptolocker.exe	88
PID 4456 wrote to memory of 376	4456	2025-03-21_05bba76e4016e739e90adc510f56cfee_cryptolocker.exe	88
PID 4456 wrote to memory of 376	4456	2025-03-21_05bba76e4016e739e90adc510f56cfee_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2025-03-21_05bba76e4016e739e90adc510f56cfee_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2025-03-21_05bba76e4016e739e90adc510f56cfee_cryptolocker.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
81KB

MD5
eb3a8bb1a06be1d975039d9afb0f3bb1

SHA1
7bc36cde2935e450596ba7a6ba6480f37fa7e28b

SHA256
24a0e59a9931c2409ea2559cc4f8cf839760f5d79c07fdf9993e454d4f899570

SHA512
d34f6a8f78a3e82f4c3ac83578b8fa8329af0181d6db580ae3ad5cce81fea5a78027be078a621d9317a98eb4c6420b976539117284c9d6e95d5de6f462469076

Download Submit
memory/376-25-0x0000000002200000-0x0000000002206000-memory.dmp

Filesize
24KB

Download
memory/4456-0-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/4456-1-0x0000000002240000-0x0000000002246000-memory.dmp

Filesize
24KB

Download
memory/4456-4-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download