e5b3262472fe9a13df4055ab18988fc2589314214cfbc41eb2253e10c207d17b

Analysis

max time kernel
132s
max time network
139s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe
Size

46KB
MD5

46c44c470bb65d674a27b7609f48aac6
SHA1

d7ca0797d1173ea99c9558b2a89cafaaacfe27f9
SHA256

e5b3262472fe9a13df4055ab18988fc2589314214cfbc41eb2253e10c207d17b
SHA512

96b982f4f7c1eadae985b8a46a55d95486705705bdd04d1db139ef9d6bfd5a681b868da3d826fc737fc2cdebb4e025baee7f8c4168fa0c9f7c51a53e105a1148
SSDEEP

768:bao/2n1TCraU6GD1a4X1XOQ69zbjlAAX5e9zg:bF/y2lFizbR9Xwzg

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2340	rewok.exe

Loads dropped DLL 1 IoCs

pid	Process
1404	2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rewok.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1404	2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe
2340	rewok.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1404 wrote to memory of 2340	1404	2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe	31
PID 1404 wrote to memory of 2340	1404	2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe	31
PID 1404 wrote to memory of 2340	1404	2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe	31
PID 1404 wrote to memory of 2340	1404	2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe	31

C:\Users\Admin\AppData\Local\Temp\2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-03_46c44c470bb65d674a27b7609f48aac6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1404
- C:\Users\Admin\AppData\Local\Temp\rewok.exe
  "C:\Users\Admin\AppData\Local\Temp\rewok.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\rewok.exe

Filesize
46KB

MD5
47d9da6d798bfa15139ce18fef7ea7ba

SHA1
f900e23e5c34f0ed9e0e6793b28a58330e1b0ecd

SHA256
02c68381ee7db480434efa54055b2a7cd3efe931a72f1b36cdb33a75cf5f803e

SHA512
57a088cc2666c836497e6038b2748771042e682d6d7862fcb0732d8f717fc491392e583501c84acd9f93e6b4ed11e7f74d8cecdf9ea956acbfe043b398b9a9b2

Download Submit
memory/1404-0-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/1404-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1404-8-0x0000000000430000-0x0000000000436000-memory.dmp

Filesize
24KB

Download
memory/2340-23-0x00000000002A0000-0x00000000002A6000-memory.dmp

Filesize
24KB

Download