Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
-
submitted
28/01/2024, 22:48
General
-
Target
2024-01-28_37050f328fa902a506cd2fa48688ddea_cryptolocker.exe
-
Size
61KB
-
MD5
37050f328fa902a506cd2fa48688ddea
-
SHA1
277cc2c14024bf5478caa83b9e1289e7609b1272
-
SHA256
04bf8f5748fbc3d15a9955040de654acc6824aad2c0c362c2de1fb46232b42b2
-
SHA512
c198540d17042155b97d15ed3f9054cbe32722ff3eb40e3a56da4219f16d8d4a35bc7ec28d604ae83028626f235552227ba77829b529f20cd7dd0b3291d52b52
-
SSDEEP
1536:o1KhxqwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZszudnYTjipvF293f:aq7tdgI2MyzNORQtOflIwoHNV2XBFV7d
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-28_37050f328fa902a506cd2fa48688ddea_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-28_37050f328fa902a506cd2fa48688ddea_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hurok.exe"C:\Users\Admin\AppData\Local\Temp\hurok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD533ebfd3ff2da7fb518c3105b6c852bb4
SHA19536480906347a9e5f30bdceba381f2be11da3cd
SHA2562377cc8721386f0c1407ca00b2613ec7dd89dd5c836565e65a9f437252da73c3
SHA512df8b2dff621f5c42510c89f4a4015c52db53ea2de1a0adb2fed4820b8240c9dfae2f497cbdbce58f64baeeafed955c3b6ad476d2214956ec255dda448f3b68cc
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB