Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
09/06/2024, 07:33
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe
-
Size
56KB
-
MD5
a316b3b422b74c083ff7f511ca2780d3
-
SHA1
10d01ada754f28c78a3ea125b72cc40247739e54
-
SHA256
d6f201cafcccaa227dda627cc4b76354028e61c6f7c00c562bc9f898eec2eaad
-
SHA512
863aa2466cc7d058e3cfac51e9af97bbe8ce965ac49478ca145630cd3f602836e5d4a62579c5f61038bc2411b1bf11f8a0267fadbfdb29bd57ecbc54bc7fa6db
-
SSDEEP
768:b7o/2n1TCraU6GD1a4Xcn62tH/1/Lp17zJIfeVEuUr6Wg:bc/y2lm6iH/NLp17zrV98g
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000d000000013adc-10.dat CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 2080 rewok.exe -
Loads dropped DLL 1 IoCs
pid Process 2036 2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2036 2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe 2080 rewok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2036 wrote to memory of 2080 2036 2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe 28 PID 2036 wrote to memory of 2080 2036 2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe 28 PID 2036 wrote to memory of 2080 2036 2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe 28 PID 2036 wrote to memory of 2080 2036 2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2080
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
57KB
MD5413cbb761e79041325ca3575c11fa46c
SHA1f86b9fbf9811a483a6a2266cd4dec20da06af218
SHA256a5468e3d138f51cb57cbe67782b3e26673967aa0299c48c6433da289d07bdaf3
SHA5123ec69e3ed2b5b9cb706c61a40669c433a9cc5d104169f529aa84a01584422e9cc696b063f7c1718bfc7516b286949991cc6872aeb85c9968dc4f83f3ab6b0e49