91eab47332ac9880bdb0ef81159a7e25c8a213e918277dd97c88391ca434afee

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
18/01/2024, 22:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe
Size

40KB
MD5

48c5883ac132ecf7d8fa1cf96bd64320
SHA1

797390da67c8dd7be195be58e8b5e676f103a7ef
SHA256

91eab47332ac9880bdb0ef81159a7e25c8a213e918277dd97c88391ca434afee
SHA512

dcff127a84e64b9298982acd4300e63d857230101684128e4d8f2e501d56cc79cb7aaaa608a5444b551871e80e2114ecc5252956097503dd9ec6c5b342ef8b57
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRqr9:bc/y2lkF0+Bjr9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012327-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2384	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2060	2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe
2384	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2384	2060	2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe	28
PID 2060 wrote to memory of 2384	2060	2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe	28
PID 2060 wrote to memory of 2384	2060	2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe	28
PID 2060 wrote to memory of 2384	2060	2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-18_48c5883ac132ecf7d8fa1cf96bd64320_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
40KB

MD5
3f4a263305cba50422dadd8bab13dd2d

SHA1
16866ab0dff3770c77199c9720376e16dfd4b783

SHA256
4212daef89a5a47b7249dbf856c2e764d7b424dcb802acf07627ab926b649a0b

SHA512
44c61062d2d0cab65a3d3457e733c0ef68c047e5a8fb4af3ed20b33a1c4329504685104d26dcfc367dc19526bc0e73313fab884a25759bd75dc2989b3727d640

Download Submit
memory/2060-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2060-0-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2060-8-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download
memory/2384-23-0x0000000000410000-0x0000000000416000-memory.dmp

Filesize
24KB

Download