Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 23:33
General
-
Target
2024-05-22_e71d3f228d2d57e3c405b2c778a3efad_cryptolocker.exe
-
Size
38KB
-
MD5
e71d3f228d2d57e3c405b2c778a3efad
-
SHA1
efbb97a2414633cf7ce71f3b50d22f9a430704b8
-
SHA256
8a9449e107fa9bc3a688f1d3ab2523eae88ee249165b4608c4c7267016ca4c33
-
SHA512
e164747cb659b083a5708c9dd9d2933d591ea1cbb4aa83661af990743fee1db8d0aa6739b7654b72a7ad7e00bd1dde223b29e02e0f9858e14ac2a60c9b163b96
-
SSDEEP
384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4XDIwNiJXxXunRSy3Vq:btB9g/WItCSsAGjX7e9N0hunRv0
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_e71d3f228d2d57e3c405b2c778a3efad_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_e71d3f228d2d57e3c405b2c778a3efad_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD511d26def4edb4a709db0e5192c2858ec
SHA1096a04f918872281aac80153e2683173702aae18
SHA25605178359bd9b14d944086effba093a29d78ab88471410c74a565f6c1e3fb9887
SHA51255f249363abc2de2b6f9caf9e240b997e50f82dc90d0690405fd54bf6d44e42a20384cb9d2eb50bd43a87fb540a7e0d896ccb231c41d9b83e40dd05ce3756fdd
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB