580d3cc6987ca1870d43467295e6b44c80b8a76d50ee409c7732f315d7ec39ce

Analysis

max time kernel
148s
max time network
152s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-05-2024 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe
Size

54KB
MD5

6b1ec2a4c21ec017749f93cece471526
SHA1

84feb321593d200db662d6fdc116e5657738677b
SHA256

580d3cc6987ca1870d43467295e6b44c80b8a76d50ee409c7732f315d7ec39ce
SHA512

3545da3742d71cd0a0448a2a58aed36d25c4a134ef1688e6a169b89c0c821bb114b8ee6deb80fb01ee1a46deb0dc31d1310d220b558c5882ee592c7fefccaacc
SSDEEP

768:b7o/2n1TCraU6GD1a4Xcn62tH/1/Lp17zJIfeVEuUr6q:bc/y2lm6iH/NLp17zrV9Y

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000012274-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2072	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
1676	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1676	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe
2072	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1676 wrote to memory of 2072	1676	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe	28
PID 1676 wrote to memory of 2072	1676	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe	28
PID 1676 wrote to memory of 2072	1676	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe	28
PID 1676 wrote to memory of 2072	1676	2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-10_6b1ec2a4c21ec017749f93cece471526_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1676
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
54KB

MD5
f5591bf965a2f1eff6895317823b639b

SHA1
dabe581e4ce7fd75b936bb9633d79ce840b9a63b

SHA256
21da3cd4ad996250353fb6fabf2baff0fecc12e6866d4581bc6a462efa67c788

SHA512
0c380018ec46fb168a8c98d5dfb358c81480ee3eda7b2077120972a554e497016ebe55e8e3f3d13e1778b6e8e0ca20e3f914063b05ecaabc8f374feee5bee207

Download Submit
memory/1676-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1676-8-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/1676-0-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2072-23-0x00000000002C0000-0x00000000002C6000-memory.dmp

Filesize
24KB

Download