73bf1e95a83aeb023eb7264ebf010c5edc2583583d65511a227b2a059c35f6a2

Analysis

max time kernel
135s
max time network
145s
platform
windows7_x64
resource
win7-20230824-en
resource tags

arch:x64arch:x86image:win7-20230824-enlocale:en-usos:windows7-x64system
submitted
30/08/2023, 15:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe
Size

37KB
MD5

ddd19fbd7dc61b84e95501653f3dd0a0
SHA1

ddf138db587bcf88fd0f89249c033890024d48c0
SHA256

73bf1e95a83aeb023eb7264ebf010c5edc2583583d65511a227b2a059c35f6a2
SHA512

d5d7ccf1fe80f2adcd36de8dace5c524f4ec3d675cb6926f0fd8a358d909744fe3c75d1ddf2083583d04fbb6eb3c3b64b613399486837cf8d391085bc50499ba
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAM+L:bc/y2lkF0+BvL

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2092	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
596	ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
596	ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe
2092	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 596 wrote to memory of 2092	596	ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe	30
PID 596 wrote to memory of 2092	596	ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe	30
PID 596 wrote to memory of 2092	596	ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe	30
PID 596 wrote to memory of 2092	596	ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe	30

C:\Users\Admin\AppData\Local\Temp\ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\ddd19fbd7dc61b84e95501653f3dd0a0_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:596
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
37KB

MD5
7153cf47a5941e83e1aedf3a4ef0352d

SHA1
b7ca768548e36ba97b2f407eebb91acf5d663d20

SHA256
a8f49bc6a72b02b5e70767072b4f82859257230ea85f78418cd5813fc0326370

SHA512
0d57a012f4a7d3b4fa081b878034b564f3f683d8792509ce939acc889b38cdebaf3dcd1ea02e1069eb76ba8455b08cc489c4656aa410c6938ab2fef8e2be44c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
37KB

MD5
7153cf47a5941e83e1aedf3a4ef0352d

SHA1
b7ca768548e36ba97b2f407eebb91acf5d663d20

SHA256
a8f49bc6a72b02b5e70767072b4f82859257230ea85f78418cd5813fc0326370

SHA512
0d57a012f4a7d3b4fa081b878034b564f3f683d8792509ce939acc889b38cdebaf3dcd1ea02e1069eb76ba8455b08cc489c4656aa410c6938ab2fef8e2be44c5

Download Submit
\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
37KB

MD5
7153cf47a5941e83e1aedf3a4ef0352d

SHA1
b7ca768548e36ba97b2f407eebb91acf5d663d20

SHA256
a8f49bc6a72b02b5e70767072b4f82859257230ea85f78418cd5813fc0326370

SHA512
0d57a012f4a7d3b4fa081b878034b564f3f683d8792509ce939acc889b38cdebaf3dcd1ea02e1069eb76ba8455b08cc489c4656aa410c6938ab2fef8e2be44c5

Download Submit
memory/596-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/596-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/596-2-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2092-16-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download