7f34b7e5315cad4a9f83947cf51ca2a24367f80fc72ca10ff1aded4592e9a66d

Analysis

max time kernel
1s
max time network
156s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22/04/2024, 04:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe
Size

43KB
MD5

5a647663b47a735324711aad5b229794
SHA1

b5dc46aeeeedda9544a3e23eecf3e6611b5e0e4c
SHA256

7f34b7e5315cad4a9f83947cf51ca2a24367f80fc72ca10ff1aded4592e9a66d
SHA512

00af120964e6049a6540b4928cfb6cf20423933375d01402a373030d72039afa2be7d2cb606d258f8370944f23af82b786cb852f56ffa62eac27a3097eaa06df
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMphqo:bc/y2lkF0+Beqo

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000014466-22.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2568	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
3000	2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3000	2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe
2568	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 2568	3000	2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe	28
PID 3000 wrote to memory of 2568	3000	2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe	28
PID 3000 wrote to memory of 2568	3000	2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe	28
PID 3000 wrote to memory of 2568	3000	2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_5a647663b47a735324711aad5b229794_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
43KB

MD5
583b6356ef6e4a436ab8b23cb6a8383d

SHA1
ecf1c63f77f5a789d4e6b097c7901b712f215f8e

SHA256
e8ca8f8aa7946d9da74ac9676b11963203b6614211d88389e4d579edbba032c1

SHA512
d3d5dda4155b99cb8329bb2fab025b7c5ac38459e0c24cf356939f06734a6b824ea2573e7b70bae4b40f9936f1b1a501e59c396e52110098ac2a4d5c6f17e31a

Download Submit
memory/2568-23-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/3000-0-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/3000-2-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/3000-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download