895144cc02b294db47a1e7ca1d3a6da816999a3582132664da408585f66afbd1

Analysis

max time kernel
149s
max time network
143s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
05-01-2024 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe
Size

38KB
MD5

09427110a7a7103704fe0427abfade58
SHA1

002e46adb5d3177a0e41640ad9dbac0aecd2cd1e
SHA256

895144cc02b294db47a1e7ca1d3a6da816999a3582132664da408585f66afbd1
SHA512

7849be4ddd0d205cddd5abbb4251785a78aaa560192c073ac507ae8e3b0cca3c2b236e69af2157ea821d02d3a337ca54cdb1248be073d21ce760eda3bc50f03b
SSDEEP

768:b7o/2n1TCraU6GD1a4Xcn62TUdcuQlqJ51GPF3:bc/y2lm6Y0AqJ51y3

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2852	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2040	2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2040	2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe
2852	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 2852	2040	2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe	28
PID 2040 wrote to memory of 2852	2040	2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe	28
PID 2040 wrote to memory of 2852	2040	2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe	28
PID 2040 wrote to memory of 2852	2040	2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-01_09427110a7a7103704fe0427abfade58_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
39KB

MD5
799c2ebe24e59f1cdf110472c9e26fe8

SHA1
ffbd23e5279d2680b2d5b1d44cebb5cb91252968

SHA256
d8f3df84632c35189c27facc4fdae95435a9b7e52b2206f01ab763a88b369652

SHA512
f25ecf221c6710827091f2967f0da6dbe5335af6a2341e2f9170bc1ddcbeeb489551e79e05aee704a507bbd6859597734f9a17b3387b434d6277b0ca2851de91

Download Submit
memory/2040-0-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2040-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2040-1-0x0000000000370000-0x0000000000376000-memory.dmp

Filesize
24KB

Download
memory/2852-16-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download