Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
22-05-2024 20:51
General
-
Target
2024-05-22_2ba4ef6cf10ade7b5b7bbe7d5526af87_cryptolocker.exe
-
Size
36KB
-
MD5
2ba4ef6cf10ade7b5b7bbe7d5526af87
-
SHA1
72819e5e5b0d0c0800db0c595de8387a711c3226
-
SHA256
3164eeb56c120fad3a999d9aaf02c2594d6887a5ba4e3b24209595c9c373ea43
-
SHA512
4d7cc8fa454481cd53651e0da97ae359b03569d993cb481cb131102f6effe2b2b10df740536f5c762fdc6a912127037ca00e4191d36d36d089dbcf76acb53720
-
SSDEEP
384:btBYQg/WIEhUCSNyepEjYnDOAlzVol6U/zzo+tkq4l8tFFxE2B0qG1H2:btB9g/WItCSsAGjX7r3BTa2
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_2ba4ef6cf10ade7b5b7bbe7d5526af87_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_2ba4ef6cf10ade7b5b7bbe7d5526af87_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\gewos.exe"C:\Users\Admin\AppData\Local\Temp\gewos.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5021bc7bbc8d688033b295d124d1e07a7
SHA10544d9bc6c39c7ddbfdba2ac18c5338589cc337a
SHA25616834a7f162308874dc4ecba03bc42b1a9b2836a7ad83bc19a433b76eab3a12f
SHA512d56a14f76cf58b30a177a65d4a0113d565b579ee7eb3010fdbcb7242550b5ee5c2f2f99440e11fdecc26441116b48b2a3e1b8b99b75d44479407f94886ed5c4e
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB