1c87ff902e2e10f02c25fcfe28309d4d33745206dc89a170f85ac026dcb65f22

Analysis

max time kernel
149s
max time network
158s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
23/02/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe
Size

32KB
MD5

6297c35c5aa074c99af382dd6df01f1e
SHA1

0fc0e14089eccbb1c024af1d80e80ce67879c69a
SHA256

1c87ff902e2e10f02c25fcfe28309d4d33745206dc89a170f85ac026dcb65f22
SHA512

7941b814f877af91345c5e49be6eb6ba4d57518e781cc054e7a7ff4fd757eaf9ce9efe46c9441bc8670a1c6a32f4595818f076a1286aad2be94ff6699a784c47
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B+wo:b7o/2n1TCraU6GD1a4Xt9Do

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000900000001227e-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3036	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
3064	2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3064	2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe
3036	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3064 wrote to memory of 3036	3064	2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe	28
PID 3064 wrote to memory of 3036	3064	2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe	28
PID 3064 wrote to memory of 3036	3064	2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe	28
PID 3064 wrote to memory of 3036	3064	2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-23_6297c35c5aa074c99af382dd6df01f1e_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3064
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
32KB

MD5
2238a6ce2d9c5aaae63551c6f366325f

SHA1
dc25e4b5ec895deaa0bc9b38e59513dbe96ce1e8

SHA256
ca4f956e535ea7f09fcc62bbe8716a425e6c239cfe31b041579c56d1bb2bfc53

SHA512
f484ab275fe90bcb564eb65cd6b7c37531e45c25057936dd4838dcba3f6809c7d099199c7fb07e758650d3f49f73f6622285e07b6eb935c50fa57b592e910e4e

Download Submit
memory/3036-22-0x00000000002E0000-0x00000000002E6000-memory.dmp

Filesize
24KB

Download
memory/3064-0-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download
memory/3064-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3064-2-0x0000000000260000-0x0000000000266000-memory.dmp

Filesize
24KB

Download