90634a3c81b01d281c9e4ac71462e2ec4916887a94789cdc088c412161456b66

Analysis

max time kernel
157s
max time network
161s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe
Size

42KB
MD5

d97101f9e58df4f360c00d3af97b0d92
SHA1

b51ce7eb3a4f098ce715ef01fba7afd85f32548d
SHA256

90634a3c81b01d281c9e4ac71462e2ec4916887a94789cdc088c412161456b66
SHA512

3dc11cadb166b350d4ba90284f792a6bd18959ce685f54ea5e0605cfc2eb6ab763517a1824d4b1ba99022b368a67c7497cd549b3c21624789210c9d8efc3dbb6
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMRqbo3a:bc/y2lkF0+BjUq

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000800000001227d-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2132	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
1676	2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1676	2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe
2132	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2132	1676	2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe	28
PID 1676 wrote to memory of 2132	1676	2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe	28
PID 1676 wrote to memory of 2132	1676	2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe	28
PID 1676 wrote to memory of 2132	1676	2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_d97101f9e58df4f360c00d3af97b0d92_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
42KB

MD5
13bfc9fbbb88eca71a66bb3563d6b9bc

SHA1
743f367dc659bc99bd35459c1242d5e77247dc40

SHA256
2e4a9b3da3a876b8d5679c757bcb013ed2bcc465c1422ceb808d175d493d3225

SHA512
6c70939024cecc865436da2817de281549c12506bd3a7f1eecbdc52da64c0bef41cb4460ea480056c82fb9794795da2957b35cc01dbd3ed6aa5e2405de1bca61

Download Submit
memory/1676-0-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/1676-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1676-8-0x0000000000330000-0x0000000000336000-memory.dmp

Filesize
24KB

Download
memory/2132-16-0x00000000002F0000-0x00000000002F6000-memory.dmp

Filesize
24KB

Download