cd6bb2ab21ddf83bc9282f164b8cba6b8c8a11e682809cb570ddf3f2bbbd56ed

Analysis

max time kernel
148s
max time network
149s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
14/05/2024, 10:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe
Size

44KB
MD5

697a58f2ce91efa3494faceaf80cbad1
SHA1

909dd250e73c62dbcb3f4b5738fc57bddc6c7eea
SHA256

cd6bb2ab21ddf83bc9282f164b8cba6b8c8a11e682809cb570ddf3f2bbbd56ed
SHA512

94b5ac4dfb5c0a7977bff859b9e73fd48c9b6d8315693c7ec57a3eebc40406e0fa26810cef3d4b9813a4509a1fa7723c775f4254ae75191c3464156b62305c56
SSDEEP

768:b7o/2n1TCraU6GD1a4X0WcO+wMVm+slAMphqD:bc/y2lkF0+BeqD

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000d000000012324-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2748	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2940	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2940	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe
2748	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2940 wrote to memory of 2748	2940	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe	28
PID 2940 wrote to memory of 2748	2940	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe	28
PID 2940 wrote to memory of 2748	2940	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe	28
PID 2940 wrote to memory of 2748	2940	2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-14_697a58f2ce91efa3494faceaf80cbad1_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
44KB

MD5
03f013ac3367ff0f0b7ba072b51c71ee

SHA1
5b2cec4dac857e7f915cfbcb6781d54b7110162f

SHA256
d2c7038b806c2ce6708c1fa5d206ae752de1baccaf28d0060d3fb24fa64c4136

SHA512
daf28620b2acb1138354ad279e4a997b26ab183e5d313bb8da2f7a34abc972ed659c092c9adf196159995c39b9ea85eff74e9d68c9e6fe5efe9c2011fc93a557

Download Submit
memory/2940-1-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/2940-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2940-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download