4b6c4d0d6c9d59fb6e5e233cefd2c0c0807c7f0f3793fd16a01ed997b3c5b32b

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
28-02-2024 20:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe
Size

33KB
MD5

a30dc4ee0ef0e46593bc2a2550501c49
SHA1

ba7eb887fc22c7acd58498bf68ee213049c1bdf8
SHA256

4b6c4d0d6c9d59fb6e5e233cefd2c0c0807c7f0f3793fd16a01ed997b3c5b32b
SHA512

e334d8182ea5216c01b05d2d7d23c4250cf5f27bdb743a7daf27ea82679eadaa42316a6eeee8af0241f5ae5e26d280bd30af4ea1968d3bb7af46ada7d8576910
SSDEEP

384:bmM0V/YPvnr801TRoUGPh4TKt6ATt1DqgPa3s/zzoCt9/B1RwFtzxt16X:b7o/2n1TCraU6GD1a4Xt9bRwrbm

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000a000000012251-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3040	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2372	2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2372	2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe
3040	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3040	2372	2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe	28
PID 2372 wrote to memory of 3040	2372	2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe	28
PID 2372 wrote to memory of 3040	2372	2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe	28
PID 2372 wrote to memory of 3040	2372	2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-28_a30dc4ee0ef0e46593bc2a2550501c49_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
34KB

MD5
7d3d13edd5e937704b7f50a420c338e6

SHA1
ea12c6d1c97235dd15c30e062df442e0daab8e64

SHA256
66f9e076ee431555bf17dac372496c1cda9217dc963c7edfc60dc63cec68fb7d

SHA512
b211c24d582764b302f36db0e4f63612256103a0ad45f746b7bde35345707427279ca3e8f0f73f3fc0f178ac4f0c7eef4630013ed98ce837cd82089e9b54858c

Download Submit
memory/2372-0-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2372-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2372-1-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/3040-23-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download