42ce6ad3304dec5f358b01dcb94da9d2416c2dfecae43ee5bdbf174e681033fd

Analysis

max time kernel
154s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
01/08/2023, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

344ffb1e36a00251b18f42c1f04b81ca_cryptolocker_JC.exe
Size

30KB
MD5

344ffb1e36a00251b18f42c1f04b81ca
SHA1

373162857ef733d16365c503dc7db20373160f20
SHA256

42ce6ad3304dec5f358b01dcb94da9d2416c2dfecae43ee5bdbf174e681033fd
SHA512

2a92f75e56ae1961caffe7352600717503977ca98625539c821697cab4f5581cf12003fbb8f7a5c894ceac53be195eabb950d325c0e03de79d4222fd08cc4753
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoi0W6WAkJUG6:b7o/2n1TCraU6GD1a4X0W6RV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
756	rewok.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 756	5000	344ffb1e36a00251b18f42c1f04b81ca_cryptolocker_JC.exe	86
PID 5000 wrote to memory of 756	5000	344ffb1e36a00251b18f42c1f04b81ca_cryptolocker_JC.exe	86
PID 5000 wrote to memory of 756	5000	344ffb1e36a00251b18f42c1f04b81ca_cryptolocker_JC.exe	86

C:\Users\Admin\AppData\Local\Temp\344ffb1e36a00251b18f42c1f04b81ca_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\344ffb1e36a00251b18f42c1f04b81ca_cryptolocker_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  PID:756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
30KB

MD5
46eb5ec53565fca122c7e43b93dade10

SHA1
51fab077fd77d1522356e3fd41dd2c1383a5f818

SHA256
e10545cf393c9fd32e3b86d95db4b732b4b05a5de297ed9be84db1863a5b1a3a

SHA512
3f2a37fd089dc44536732d207f7b6f36f1ab79547a567639f7f8220acbb57a90fe193025dac65e739e67e11b0d903bdbea7b66f8691d29ab93c18da768efcf4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
30KB

MD5
46eb5ec53565fca122c7e43b93dade10

SHA1
51fab077fd77d1522356e3fd41dd2c1383a5f818

SHA256
e10545cf393c9fd32e3b86d95db4b732b4b05a5de297ed9be84db1863a5b1a3a

SHA512
3f2a37fd089dc44536732d207f7b6f36f1ab79547a567639f7f8220acbb57a90fe193025dac65e739e67e11b0d903bdbea7b66f8691d29ab93c18da768efcf4b

Download Submit
C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
30KB

MD5
46eb5ec53565fca122c7e43b93dade10

SHA1
51fab077fd77d1522356e3fd41dd2c1383a5f818

SHA256
e10545cf393c9fd32e3b86d95db4b732b4b05a5de297ed9be84db1863a5b1a3a

SHA512
3f2a37fd089dc44536732d207f7b6f36f1ab79547a567639f7f8220acbb57a90fe193025dac65e739e67e11b0d903bdbea7b66f8691d29ab93c18da768efcf4b

Download Submit
memory/756-153-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/5000-133-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/5000-134-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/5000-135-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download