0847f0f94a1fd750f2776f0a7f86909589b62580b9196aa599b95a80a4e7c9fa

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
17/02/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe
Size

44KB
MD5

1980d653355b68b7b79ea621a698e756
SHA1

e7fde48069c069cdb12db558777be580b74701b3
SHA256

0847f0f94a1fd750f2776f0a7f86909589b62580b9196aa599b95a80a4e7c9fa
SHA512

cdba5fbd06caaec5985533bc4d2e2f89837bf2d369d10578e686163bd81fb92941a0dd50247afa148a1ddf084100101d05431b8ddab2a2efe252e6d04823a906
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMphe56:bc/y2lkF0+Bel

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0009000000014b70-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3004	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
1988	2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1988	2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe
3004	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 3004	1988	2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe	28
PID 1988 wrote to memory of 3004	1988	2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe	28
PID 1988 wrote to memory of 3004	1988	2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe	28
PID 1988 wrote to memory of 3004	1988	2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-17_1980d653355b68b7b79ea621a698e756_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
44KB

MD5
67a9637cd0e9295a27b23570c9dcf881

SHA1
4fa92dfe2bb389aece6c10f94b638943079699b3

SHA256
7000e852d2f9a92491d370f14de68077db3bc122fbf3de92725ff47cf08f7b67

SHA512
537be8c43abb9bac9242bf2d105d0c73acbb1925048d5ba7a3e2452c7fb7a858fb0ccd31d89a33a2b1e0ad2b0aeaffcc61a9d0359bbf29b033a48b3bf2893e3a

Download Submit
memory/1988-0-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/1988-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1988-8-0x00000000004F0000-0x00000000004F6000-memory.dmp

Filesize
24KB

Download
memory/3004-23-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download