a6962899f0ecc71787970bf635d23363835c7801242a57d8de63134d869cc5ae

Analysis

max time kernel
148s
max time network
148s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
14/06/2024, 19:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe
Size

45KB
MD5

33a5d31a98252e33505837588cad0d9d
SHA1

68ac4212fa941c51354a77337c72fd9395f72e46
SHA256

a6962899f0ecc71787970bf635d23363835c7801242a57d8de63134d869cc5ae
SHA512

c4174104fd5a74776e3069aa6d9e74ee21640fca0a000f117abaa56f66ccd504a30cbf252cb89fe69be5a5e4a99763f381ae60e29f1b4e2241d8548e1f075b8b
SSDEEP

768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zU:bF/y2lFizbR9XwzU

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b000000015d59-14.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
2748	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
2252	2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2252	2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe
2748	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2252 wrote to memory of 2748	2252	2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe	28
PID 2252 wrote to memory of 2748	2252	2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe	28
PID 2252 wrote to memory of 2748	2252	2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe	28
PID 2252 wrote to memory of 2748	2252	2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-06-14_33a5d31a98252e33505837588cad0d9d_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
45KB

MD5
cbb18a5d737f9deed8f71d0c7103ea24

SHA1
fe14403e1a45a01dd2bf4e901afe7ac33d8c1daf

SHA256
209a47142476d487d7f863ba794eb159ca813d0ba7131f3e640d029501978ddf

SHA512
fff714a85ee2063f40e61ff7210359935dcf51e58d32e6632933159320c8a01ca8eb8272a5b3762de1c51cb8fcd0e47d9a520759922c8fe19ab07cf926cc09c8

Download Submit
memory/2252-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2252-8-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2252-0-0x00000000004B0000-0x00000000004B6000-memory.dmp

Filesize
24KB

Download
memory/2748-16-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download