9500dce835dca518f0d5abffce9618c7e549ab38d9d12b7cdfecb3fc43a95236

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12-02-2024 17:44

Target

2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe
Size

32KB
MD5

983070050305f2904e6b4a4da232ab75
SHA1

e9a32b2dcde5029be46d1c2fcc8548630b7cb84f
SHA256

9500dce835dca518f0d5abffce9618c7e549ab38d9d12b7cdfecb3fc43a95236
SHA512

1581b8ead8d114a7052d6894624a821c4fb4a4cb6afe652e5fc05bf43ed3b775764c5bffb38421518046452e257910b253e4d594cb28f75a13fa340aada13a7c
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B1RwFtl:b7o/2n1TCraU6GD1a4Xt9bRw9

Score

9^/10

Detection of CryptoLocker Variants 2 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\rewok.exe	CryptoLocker_rule2
\Users\Admin\AppData\Local\Temp\rewok.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

rewok.exe

pid process

2216 rewok.exe
Loads dropped DLL 1 IoCs

Processes:

2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe

pid process

2536 2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exerewok.exe

pid process

2536 2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe
2216 rewok.exe

pid	process
2216	rewok.exe

pid	process
2536	2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe

pid	process
2536	2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe
2216	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe

description	pid	process	target process
PID 2536 wrote to memory of 2216	2536	2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe	rewok.exe
PID 2536 wrote to memory of 2216	2536	2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe	rewok.exe
PID 2536 wrote to memory of 2216	2536	2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe	rewok.exe
PID 2536 wrote to memory of 2216	2536	2024-02-12_983070050305f2904e6b4a4da232ab75_cryptolocker.exe	rewok.exe

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
14KB

MD5
09c160eb521b3fe39e1e46b64fad334f

SHA1
4fa7c247b6772c8f1657f48d7cf58a4f1cdef59a

SHA256
afadcd12571057bf5d2b16e1abd5a0a090359678be86cc9f7aec0b339ad0b3c6

SHA512
50e699953f3019bbc30eb3870912bd4903d73954510eb7abfe8383848ecab0f49ca8e2cf0fccc9bf73fcb53ce65fe307b42a4d7106b20ee4792bb98b1df5a94e

Download Submit
\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
32KB

MD5
b3dd6f7aac7c05a0bf1845099607d01c

SHA1
1ab42701aa4e5fce891608170a63157a1182fff3

SHA256
c9bacb05548a53d0c594b2eeb1767346fe23f9cff8541d5025260b5ad73fa2e3

SHA512
e1b5cfc49b393a37045d1d3162fdd0aae6d858fc1872163c29dac0ec93f62e0e1efb64e5e2babba72cc4831df4c7d90a7fa738645c2b1b73cc89edef9264141d

Download Submit
memory/2216-18-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2536-0-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download
memory/2536-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2536-8-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download