Analysis

  • max time kernel
    149s
  • max time network
    155s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    19-09-2024 11:33

General

  • Target

    2024-09-19_ef007e8545cf42d74ae526b66356e53c_cryptolocker.exe

  • Size

    40KB

  • MD5

    ef007e8545cf42d74ae526b66356e53c

  • SHA1

    008e5daa2f8dbae55a7f0d913a588521e4c22020

  • SHA256

    abe34a525fe6ed5ffbdbd0ac985004aa6bd392a1d77a9a28060067c333886052

  • SHA512

    2ecf7d101a7871bb21b9e56c20d223ff639d17be008a791a5c8b906d1713aea8a55a64e57fb68a22b0a990606df558ab65fb4cf542bef7a9bfcf9296c9d93fe4

  • SSDEEP

    768:b7o/2n1TCraU6GD1a4Xcn62TUdcuQlqJ51mwoI:bc/y2lm6Y0AqJ51mwoI

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-09-19_ef007e8545cf42d74ae526b66356e53c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-09-19_ef007e8545cf42d74ae526b66356e53c_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1656
    • C:\Users\Admin\AppData\Local\Temp\rewok.exe
      "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of UnmapMainImage
      PID:2432

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\rewok.exe

    Filesize

    40KB

    MD5

    958ef4d4b54a5075aeb00fcff64400d4

    SHA1

    48d9359b9638033d31cc43a572ec375d9c0eab7a

    SHA256

    3d1583fdff8b2105325b45d28f4a6bf6c354415c16f1193e9091bb4619eff6bd

    SHA512

    6ef0f07a075ee26604c1cc2aaf176ba047497d9a9230d4318ceea38b6136ac444044c38656167343ec5bc9dd16ff721cbbad460c8e6350466190f8cc5b1c05b1

  • memory/1656-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1656-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/1656-8-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/2432-23-0x0000000000370000-0x0000000000376000-memory.dmp

    Filesize

    24KB