9bd8e073b6c1f5dbff20dfa0400927d2e476a4da236268ae23ffeed7fd64cc12

Analysis

max time kernel
149s
max time network
155s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/02/2024, 09:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe
Size

32KB
MD5

21d3797a9e4ad32a1020fa62706e4c8d
SHA1

d6d7c5e326f9ef253fa08cf78a2904f0fec3750a
SHA256

9bd8e073b6c1f5dbff20dfa0400927d2e476a4da236268ae23ffeed7fd64cc12
SHA512

d6a916cd02a6f312958c14aaa9f777fca66b140f781d63b5562bce5e72f3a3ab9c1a261d9607adf603f13ed75f1225ee527826fd68e11809a6dba09c1d1eade2
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B+OOd:b7o/2n1TCraU6GD1a4Xt9h6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012267-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2328	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
3012	2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3012	2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe
2328	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2328	3012	2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe	28
PID 3012 wrote to memory of 2328	3012	2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe	28
PID 3012 wrote to memory of 2328	3012	2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe	28
PID 3012 wrote to memory of 2328	3012	2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-22_21d3797a9e4ad32a1020fa62706e4c8d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
32KB

MD5
e70ea53632526f2edfbc66b4c83dcebd

SHA1
68a5332407e717324027423b02769a7bccfb0359

SHA256
6b4e09c8b479579c378944e25434ce3f370c513e53da037a1e73e70315bd3984

SHA512
8b264b5c53b0507e9420096937cc83358f2c63deaad42f256b7e2faf6896fde897dc418260746ec42944d47d08191d689e8e297514642e3d247c38dfd2944ed9

Download Submit
memory/2328-17-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/3012-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/3012-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3012-2-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download