44ef1ca6a81f096fa49f225c3ecf04b99a0e1949a28850cc2607acfd8d44a448

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7-20231020-en
resource tags

arch:x64arch:x86image:win7-20231020-enlocale:en-usos:windows7-x64system
submitted
22/10/2023, 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe
Size

39KB
MD5

393311f76f83cd894c7038e61f214f7b
SHA1

c4b7e3cff7e8fa982fbb3721cefced16c2b59265
SHA256

44ef1ca6a81f096fa49f225c3ecf04b99a0e1949a28850cc2607acfd8d44a448
SHA512

3c21abcbfb6cca337ebddf7ce64ddf052813fe9f415a6181f077f4e6a95a2ed8e52c547be54f74ffd28a8db8c3de5f488f345d3efd63e6a17f0c46e8082ffcca
SSDEEP

768:b7o/2n1TCraU6GD1a4Xcn62TUdcuQlqJ51mwV:bc/y2lm6Y0AqJ51mwV

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
588	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
1736	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1736	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe
588	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 588	1736	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe	28
PID 1736 wrote to memory of 588	1736	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe	28
PID 1736 wrote to memory of 588	1736	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe	28
PID 1736 wrote to memory of 588	1736	NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-06_393311f76f83cd894c7038e61f214f7b_cryptolocker_JC.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
40KB

MD5
795b19787fd72c9a9d7ceacbe476b57f

SHA1
aea617a73a6deb6d223289b69dd014791a93c7cd

SHA256
c217a0af307de9cb12741ee155e631ca0d20dc66a40b2f47e8ccfd96a3bcab30

SHA512
283ecdd34f99b5582aa6e00330b7dfca0de66573d089ce00541d3726d86269305f72ed6f313338c28e340a1a92d3fc94cc389d8f465f22853f556e0886563907

Download Submit
C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
40KB

MD5
795b19787fd72c9a9d7ceacbe476b57f

SHA1
aea617a73a6deb6d223289b69dd014791a93c7cd

SHA256
c217a0af307de9cb12741ee155e631ca0d20dc66a40b2f47e8ccfd96a3bcab30

SHA512
283ecdd34f99b5582aa6e00330b7dfca0de66573d089ce00541d3726d86269305f72ed6f313338c28e340a1a92d3fc94cc389d8f465f22853f556e0886563907

Download Submit
\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
40KB

MD5
795b19787fd72c9a9d7ceacbe476b57f

SHA1
aea617a73a6deb6d223289b69dd014791a93c7cd

SHA256
c217a0af307de9cb12741ee155e631ca0d20dc66a40b2f47e8ccfd96a3bcab30

SHA512
283ecdd34f99b5582aa6e00330b7dfca0de66573d089ce00541d3726d86269305f72ed6f313338c28e340a1a92d3fc94cc389d8f465f22853f556e0886563907

Download Submit
memory/588-16-0x00000000005A0000-0x00000000005A6000-memory.dmp

Filesize
24KB

Download
memory/1736-0-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1736-2-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download
memory/1736-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download