Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
-
submitted
21-05-2024 15:45
General
-
Target
2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe
-
Size
63KB
-
MD5
cf5e5b56266476c1eb498784ac6065c7
-
SHA1
ed7c58e12da6ad13b948e217d7eb48a7006959de
-
SHA256
4d06b199e76f031fecafcdd9ec1cd9cc14e0a4db5f13adeca442c10ad41852a5
-
SHA512
fea75339a7bda329d10566f69fe298d1daa1ba07b5ca7c4b3c33ffdf2c4dee8684d39c688f8622937268b958c8486e24ba431a3744bbd434596f34d49b2daaac
-
SSDEEP
1536:btB9g/xtCSKfxLIc//Xr+/AO/kIZ3ft2nVuTKB6nggOlHdUHZnF:btng54SMLr+/AO/kIhfoKMHdaF
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_cf5e5b56266476c1eb498784ac6065c7_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
63KB
MD5661575220c5cb21214f098d2331ddb35
SHA15f9b7e275872476b2fa3c90922ed549a4873b881
SHA25659f447ad02e190f2f6f564c5736306c9f4327ed0b8471ea18199f13d0836809e
SHA5121579db811f45665b481eed6ef6b0a95706c4d68b75cff3e2684df1b912116b22390d479055e3d4d696bf75acfcfe4d71f20be4c08878f0a38d0c76a95eb843a5
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB