ff9be2ac7d85452c8ecf1e3b1c9a00beb0f2b33b5f9c007c8397fdf897c5f08f

Analysis

max time kernel
149s
max time network
142s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
29-04-2024 03:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe
Size

44KB
MD5

904004c2df9c3faeb2cce2a7729a852b
SHA1

f364046e678a61a283aa3cd0204c8e0f9aae3b86
SHA256

ff9be2ac7d85452c8ecf1e3b1c9a00beb0f2b33b5f9c007c8397fdf897c5f08f
SHA512

5d23ad7c9bdf118ba2bbd5a6bc3eaf5e1da4e6e09e6f7282977c49d0ba4e069bf2b9bf8daf469cbd27f27e8a941779090d08c7ab8172cf32d9d40829e689ed2a
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMvcWp8EB0xxP:bc/y2lkF0+B2j8C0nP

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000e000000014698-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2632	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2660	2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2660	2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe
2632	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2632	2660	2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe	28
PID 2660 wrote to memory of 2632	2660	2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe	28
PID 2660 wrote to memory of 2632	2660	2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe	28
PID 2660 wrote to memory of 2632	2660	2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-29_904004c2df9c3faeb2cce2a7729a852b_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
45KB

MD5
ed062c04c6876d2091a1d272f19e48bd

SHA1
c09efe83ae73963e14f7eb5dae70367c7035a00c

SHA256
0243fcc6ae1d4b12d776a7621f3c31765c1b6182d650f9ea93873a8c6287cfd7

SHA512
53a6db0dd37e753f1f0b5d204aa413d767d3faf85e93440a887f92c876d1ecab50801839e17f1cb1d669df378a9aaba27e32e941826401e9eac08580ee2caf3d

Download Submit
memory/2632-16-0x00000000003E0000-0x00000000003E6000-memory.dmp

Filesize
24KB

Download
memory/2660-8-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2660-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2660-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download