6760e3b8c86bf54e6d6b76be249ac6cc2b0c91c8e8d5fd036ababa7eef949e0e

Analysis

max time kernel
150s
max time network
153s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14/02/2024, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe
Size

42KB
MD5

0bfef9eca922139f26dc131df91b63de
SHA1

ca2cc21a80330111129242093b4e1b0a9caf555f
SHA256

6760e3b8c86bf54e6d6b76be249ac6cc2b0c91c8e8d5fd036ababa7eef949e0e
SHA512

f4a9acaac4c013ad1e6b9a974225697e6890f72aa22a192c430b895e3a43d4395cea74f8dc5a295a9a78fbc2e08be829949f712ace878b1fb23e0b7a04a7a74f
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRqC:bc/y2lkF0+BjC

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012252-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2732	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2908	2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2908	2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe
2732	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2908 wrote to memory of 2732	2908	2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe	28
PID 2908 wrote to memory of 2732	2908	2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe	28
PID 2908 wrote to memory of 2732	2908	2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe	28
PID 2908 wrote to memory of 2732	2908	2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-14_0bfef9eca922139f26dc131df91b63de_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2908
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
42KB

MD5
bab5928e8a68cfa3d7d9840e0252e550

SHA1
ccc6cf4e1af7ebdaf50b043e9fd174eda62c8ddb

SHA256
dd163a85ef0453aaa277931cbdfae1f64580e174eb6d41643cea6f60965ce347

SHA512
8941eb733e8dc471880cae15c6a92c7b04b46afdd5217be5e18c65f009e4e61166ca9889c7ca7d3994ffd749035a534ae6d68376840da2d82a920b6cd56eeeab

Download Submit
memory/2732-23-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2908-0-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2908-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2908-8-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download