Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
-
submitted
22-05-2024 02:53
General
-
Target
2024-05-22_e8fc18d3e48a2ff58d8ed5b5b3881978_cryptolocker.exe
-
Size
38KB
-
MD5
e8fc18d3e48a2ff58d8ed5b5b3881978
-
SHA1
c69885face728c4d7b77b6e151888a2d1257d9b0
-
SHA256
1a9c91513b6a157f8b05814bd5c11d04cb5accb0dfac15990952cee5f2283256
-
SHA512
5c36df68a7e8f8451a6193e0701533eb5718d721babc0be8aa4c344d3506e4689356d31d6630774e6164629765b6f30c0e9eb65342319ee2111f9ac7e2348c76
-
SSDEEP
768:b7o/2n1TCraU6GD1a4Xt9bRU6zA6o36mq:bc/y2lLRU6zA6qq
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_e8fc18d3e48a2ff58d8ed5b5b3881978_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_e8fc18d3e48a2ff58d8ed5b5b3881978_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\rewok.exe"C:\Users\Admin\AppData\Local\Temp\rewok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD513e9c409dcfe304a8d36280648353925
SHA177cdadac509f2739dcaf6f689f7e770a9400ad5a
SHA2569a07409d8b2fcd6d7721d86044fe3c01bc53b4148ab04f314003cd516bc63ad6
SHA51261661a9796d4f713dc4e0ee4162fab9ad4684ae8d5b143983f82e11e0420e5f40df8f59e15da977b21b506cd42ccaa076b209531f7a634950f656278e4d9a93d
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB