36f17d4cfa0db23f0327911892058a2bb80ff8995c2dbd9eb6594cebe741cd7d

Analysis

max time kernel
148s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
25/02/2024, 13:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe
Size

42KB
MD5

7c1e335d86ba201a14633606c4a8e996
SHA1

22f4bd839375c4cc6e1293f199728e6f0eeeb12c
SHA256

36f17d4cfa0db23f0327911892058a2bb80ff8995c2dbd9eb6594cebe741cd7d
SHA512

69fa30c448069125a3f13e8854461b92efb690f3d6597c0d494b82c203b9cfcb4cad963cc48cfbae33422acb7ce296f0e17575430b57b7c25c1b13e24034c814
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRqrwG9:bc/y2lkF0+Bjrd9

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012302-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2580	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
1740	2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1740	2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe
2580	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 2580	1740	2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe	28
PID 1740 wrote to memory of 2580	1740	2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe	28
PID 1740 wrote to memory of 2580	1740	2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe	28
PID 1740 wrote to memory of 2580	1740	2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-25_7c1e335d86ba201a14633606c4a8e996_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
42KB

MD5
3c0b9de8017348796a1932dee7a6353a

SHA1
3537c92a4a3ccc28ce01dd1befbb111f499229ce

SHA256
4526942c2243a2bad9f3957e740f2337536388ee80d08f709669dd3496366afc

SHA512
96e553e7db339d6347b56157620242377b6a0951a656e2a5e2f18fedd1ce7b9509ce289007ca240821f23349a083ba837ea2b666984bda33c92126914a7a65be

Download Submit
memory/1740-0-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1740-1-0x0000000000350000-0x0000000000356000-memory.dmp

Filesize
24KB

Download
memory/1740-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2580-18-0x0000000000490000-0x0000000000496000-memory.dmp

Filesize
24KB

Download