Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    09/06/2024, 07:33

General

  • Target

    2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe

  • Size

    56KB

  • MD5

    a316b3b422b74c083ff7f511ca2780d3

  • SHA1

    10d01ada754f28c78a3ea125b72cc40247739e54

  • SHA256

    d6f201cafcccaa227dda627cc4b76354028e61c6f7c00c562bc9f898eec2eaad

  • SHA512

    863aa2466cc7d058e3cfac51e9af97bbe8ce965ac49478ca145630cd3f602836e5d4a62579c5f61038bc2411b1bf11f8a0267fadbfdb29bd57ecbc54bc7fa6db

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4Xcn62tH/1/Lp17zJIfeVEuUr6Wg:bc/y2lm6iH/NLp17zrV98g

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-09_a316b3b422b74c083ff7f511ca2780d3_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2036
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2080

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    57KB

    MD5

    413cbb761e79041325ca3575c11fa46c

    SHA1

    f86b9fbf9811a483a6a2266cd4dec20da06af218

    SHA256

    a5468e3d138f51cb57cbe67782b3e26673967aa0299c48c6433da289d07bdaf3

    SHA512

    3ec69e3ed2b5b9cb706c61a40669c433a9cc5d104169f529aa84a01584422e9cc696b063f7c1718bfc7516b286949991cc6872aeb85c9968dc4f83f3ab6b0e49

  • memory/2036-0-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2036-8-0x0000000000290000-0x0000000000296000-memory.dmp

    Filesize

    24KB

  • memory/2036-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2080-23-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB