b39a4c2b0709ae8b872891629dd73b4155d4fbf4105477f91d3b62ae3b064d59

Analysis

max time kernel
149s
max time network
152s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
28/01/2024, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe
Size

42KB
MD5

c790968cbf3c358e85eaa0f32126b661
SHA1

148d64ee511e93f291451d982b0eab2a5d9040f3
SHA256

b39a4c2b0709ae8b872891629dd73b4155d4fbf4105477f91d3b62ae3b064d59
SHA512

23dffd035cbc031a6ce872d9dd5a4725d6d9e87cb3e118ab1ea61c71b6b588ea2835d82932460a4d8401899e0f5a9e2aa63ec8ea73af818b48242741729b59a7
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRqmzWQA:bc/y2lkF0+BjZ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012243-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2704	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2416	2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2416	2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe
2704	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2416 wrote to memory of 2704	2416	2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe	28
PID 2416 wrote to memory of 2704	2416	2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe	28
PID 2416 wrote to memory of 2704	2416	2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe	28
PID 2416 wrote to memory of 2704	2416	2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-28_c790968cbf3c358e85eaa0f32126b661_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2416
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
42KB

MD5
fb0095d33c05048cd9cc198e37cdc45a

SHA1
8c8fb9f85f6209dc875f2ca96b5f351f2e4a2bcd

SHA256
c676ab43a90e87abe6150347d8d985e9f11888a98945863c34a7eaa44e912e06

SHA512
446a5156ea6e6d7e6fb9a5ccecea77e49d981860e36c96040bb1679aeb6b8d37856d7ea339a6e1a05b9dd7177b655b4d8405a29e6ce30e63f569322ead4b14f8

Download Submit
memory/2416-0-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2416-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2416-2-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2704-23-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download