Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
27-04-2024 22:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe
Resource
win10v2004-20240419-en
General
-
Target
2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe
-
Size
44KB
-
MD5
28ea5e7984bf10c0f200968800a1997e
-
SHA1
93c919c6d65c3e82aaa2c2eb164298cb1c7f81ca
-
SHA256
175c603f5974dbbc1ca85598202f82e9fa1342dcddaf1b68ac99348975e15978
-
SHA512
56c884292213c1cefe83b3855958f959d18e5ab7e83443f8b7025c7c6437225e91d20c04347b47a3db257346f9e33294768bbcd587600bd30be5573aa7314c08
-
SSDEEP
768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMvcWp8EB0xx9:bc/y2lkF0+B2j8C0n9
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\rewok.exe CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
Processes:
rewok.exepid process 2548 rewok.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exepid process 2932 2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
Processes:
2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exerewok.exepid process 2932 2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe 2548 rewok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exedescription pid process target process PID 2932 wrote to memory of 2548 2932 2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe rewok.exe PID 2932 wrote to memory of 2548 2932 2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe rewok.exe PID 2932 wrote to memory of 2548 2932 2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe rewok.exe PID 2932 wrote to memory of 2548 2932 2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe rewok.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-27_28ea5e7984bf10c0f200968800a1997e_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2932 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\rewok.exeFilesize
44KB
MD54b322b2d227076f8891b08de28f2d300
SHA1db638b2bb4603b2cde1d2eabb2ae346b9132ac34
SHA256b782484656bb156bfaaf1575603261a96382fe7b8bc749b9f4f349d5ddeabe98
SHA51284da5672d4a4cd1b6df5024d94dee1f14ad5631d0dc3a5fe37ecbdc4d0dd206f5ae180e76123e80643eab9ebb8ca9cf7eaa020fd7598e2c69a3058917065e9f1
-
memory/2548-23-0x0000000000280000-0x0000000000286000-memory.dmpFilesize
24KB
-
memory/2932-8-0x00000000003F0000-0x00000000003F6000-memory.dmpFilesize
24KB
-
memory/2932-1-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2932-0-0x00000000003F0000-0x00000000003F6000-memory.dmpFilesize
24KB