Analysis
-
max time kernel
148s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
21-05-2024 16:07
General
-
Target
2024-05-21_fb8a993ff85c9bd3e3c39f3e3a24f206_cryptolocker.exe
-
Size
38KB
-
MD5
fb8a993ff85c9bd3e3c39f3e3a24f206
-
SHA1
c6a4168932754e544cc46e2635e2a364a9a23701
-
SHA256
afadcb46bc15ba8ed5502e98cec2451cac0f00b341b48c8b13b70572f3e029ba
-
SHA512
26ad35e41b1e2ec6d515afa9f4a447c4767643d37909e389c3bd9bb11df55185edef4e13b55aa0fb4b691a6453dd7014b6dcf137d64a68ad18cb6ec5eb828cc7
-
SSDEEP
768:b7o/2n1TCraU6GD1a4Xt9bRU6zA6o36xpD:bc/y2lLRU6zA6lpD
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-21_fb8a993ff85c9bd3e3c39f3e3a24f206_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-21_fb8a993ff85c9bd3e3c39f3e3a24f206_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD54a8860fe7b20cc2e7ccba0e0a68bd4ce
SHA1f30456a0aa6e62a53fbafc916ef96bc5d23e8611
SHA256906550067bdfc8534552e73ddaad5b94ba896dd4411848ef5cd5c0dbb1cace98
SHA512b67c117741223fbe4097dd82847d837d641e3334f70f4ec791ed0bf8c02bd69d5c8e20164ef7e61a5eec3dfd33e8b86407980533ff239f7bbdb0c82a452de2d1
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB