Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
25/08/2024, 06:55
Behavioral task
behavioral1
Sample
2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe
Resource
win7-20240729-en
General
-
Target
2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe
-
Size
54KB
-
MD5
a76390fafba98b5d45bd1d8b9590515f
-
SHA1
098732ec09a85f89b887ecb3b092844ed33f2cd9
-
SHA256
c41d4004f10d1594470160dd951d8d974fe1a5fa29025be7995b02eecd94106d
-
SHA512
e0c7cf5c070a93de18b3acd878fb0fbc4c836cf63f651de30e2db123cd721f3e5f79bf5e1b5fcbf591ec9c4b6bb2de50c7d4dc865859e007d4161202da2bed2e
-
SSDEEP
768:bco/2n1TCraU6GD1P2wZEjbhxnbcuyD7U9kXDn62tH/1/LpPFP8H:b7/y28wZEjbnouy8G76iH/NLpq
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2248 rewok.exe -
Loads dropped DLL 1 IoCs
pid Process 2688 2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe -
resource yara_rule behavioral1/files/0x00070000000120fe-24.dat upx behavioral1/memory/2688-0-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rewok.exe -
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2688 2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe 2248 rewok.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2688 wrote to memory of 2248 2688 2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe 30 PID 2688 wrote to memory of 2248 2688 2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe 30 PID 2688 wrote to memory of 2248 2688 2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe 30 PID 2688 wrote to memory of 2248 2688 2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-08-25_a76390fafba98b5d45bd1d8b9590515f_cryptolocker.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
PID:2248
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
55KB
MD511964a9b6cfba36811d1d684bef72eaa
SHA15458addf44be51a158b3f3b3e16c29506ebde09f
SHA256674d349b2b7bdd4be1d969e618107fceb3808e0064c96df90ee3ff8b54bb4d8a
SHA512cc874f80dadd3a1ee2d109173e5d7423c1b4a9f8b16667603b79c1c9de335dab48b9952476d81ece5389e85fd7a76d70ecd8b99617cfcab312fd157105d95453