353a5f582e9b0f5e6648eebb8c0def24a2fc4f74b99de453053914e1b0e40346

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 21:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe
Size

33KB
MD5

437e4d9d26f7ef701aeb1ac8b0c4e822
SHA1

45d0915fcbd0223905aba46d6a22bf288cd02da3
SHA256

353a5f582e9b0f5e6648eebb8c0def24a2fc4f74b99de453053914e1b0e40346
SHA512

52a88ba8b3e7da9806e56d80f4737dbb273cb9fc98850d2d9fc9ae76db8a5188b3df3fe0d45cb2e0392e998206a1bec82e9de5705586a8e611a388bd47e813e4
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B1RU3qvYjg1:b7o/2n1TCraU6GD1a4Xt9bRU6vD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c00000001232d-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2376	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2212	2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2212	2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe
2376	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2376	2212	2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe	28
PID 2212 wrote to memory of 2376	2212	2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe	28
PID 2212 wrote to memory of 2376	2212	2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe	28
PID 2212 wrote to memory of 2376	2212	2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_437e4d9d26f7ef701aeb1ac8b0c4e822_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
33KB

MD5
ff31e70bad8ae74e5e69e209f85a6cad

SHA1
886a667a72f6a507c56b16548a90ea405ef676e8

SHA256
6dc1c25cf99423a7c03f6a35514ec34b8dbe33df1aeeb9c3abb34313d68e1365

SHA512
7e0b5ffd394ff9566327fbb5649182332e723b89f3838786502e7dc7b847355f823a3951a552b1f6203b42e1e8d5c3af9bae8f0f3b46b12e6fa1f7e427025701

Download Submit
memory/2212-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2212-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2212-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2376-17-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download