Analysis
-
max time kernel
148s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
26/04/2024, 05:33
General
-
Target
2024-04-26_4e6b2b7903fd8f71350c080340aa1765_cryptolocker.exe
-
Size
55KB
-
MD5
4e6b2b7903fd8f71350c080340aa1765
-
SHA1
7270ea33a6038eeb7a179d6c023b647cad3076ad
-
SHA256
bce10e6c8c2bf88f48fddf42b9f4df40fe3ef655012ae78600597a32b39e9107
-
SHA512
038b53eddd39386f28722bcf78143f525933ada519fe4b586af0bcfa527326adb670c3697d5b0dd3f9fd74d1609230ae8e10f7088db625e9b59204ff9465998e
-
SSDEEP
768:bP9g/WItCSsAfFaeOcfXVr3BPOz5CFBmNuFgUjl+i:bP9g/xtCS3Dxx0Ji
Malware Config
Signatures
-
Detection of CryptoLocker Variants 4 IoCs
-
UPX dump on OEP (original entry point) 4 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-04-26_4e6b2b7903fd8f71350c080340aa1765_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-26_4e6b2b7903fd8f71350c080340aa1765_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
56KB
MD52fa2fb0ece9933355dce3dc622e6cf34
SHA12312ccd8106dc26dd07267ff80af700db9c402f9
SHA2564b7ea42d8dc00122967142b54f2d2d27cf9d901fe17877fa709e0a04eed1654d
SHA51277cbdb48faa61b831242a43da8b2f99c04027fef12246d3c5f230b38adc3f28e492e124ff6c3e40a668c8de7e4cacf4a99b2053d044c71a5a17da172448b4916
-
Filesize
56KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
56KB
-
Filesize
56KB
-
Filesize
24KB