Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
-
submitted
03/06/2024, 03:38
General
-
Target
2024-06-03_4a7a77b785db123cae23640bd483e8f8_cryptolocker.exe
-
Size
38KB
-
MD5
4a7a77b785db123cae23640bd483e8f8
-
SHA1
6357aa1c336afbbdb885dbe29ec50c4afa739ee4
-
SHA256
7c4bd5af90cb4de9499ca4bbabdf124d71842437e6415c1211f02f9064e31813
-
SHA512
deac7fbbe7e48d178e1d0227f8195ca81a15d0e58f1d0e449fc7c923c7a9879ef90614c36dc86caaae3a29be8f6bdc5ecc242d945af423cfd3abaa3685c74a84
-
SSDEEP
768:Kf1K2exg2kBwtdgI2MyzNORQtOflIwoHNV2XBFV72BOlA7ZsBGGp/YIm7wm0U7:o1KhxqwtdgI2MyzNORQtOflIwoHNV2X4
Score
9/10
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
-
Detection of Cryptolocker Samples 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 1 IoCs
-
Suspicious use of UnmapMainImage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-06-03_4a7a77b785db123cae23640bd483e8f8_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-06-03_4a7a77b785db123cae23640bd483e8f8_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\hurok.exe"C:\Users\Admin\AppData\Local\Temp\hurok.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD5c536cff1cfcb4bf613044aa0bb62b845
SHA1310cd313be9b28f879724749bc3183bb87221dc3
SHA25618c1778faeb1243bfbbe16345604e0f6dd8300479e1b922b4efd0dc1d74a863a
SHA5120a9242cbc0af7b087cc08026d2fa85614bd88724925b76f9062ef21b2066eaec066960c0c7fe58e8ba4475f712a4a58f1310a4fa9f03bbd2af7f24d24300c1af
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB
-
Filesize
24KB