a7c1a93e270531b4a61c0d7be268854c95da833a8ee3f58f517e76dace84d1ba

Analysis

max time kernel
3s
max time network
81s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
07/01/2024, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe
Size

38KB
MD5

b3f8a74425b34dfa6e9187e9a0696ce5
SHA1

51d6ee28e30157f13643422eabfe7787912c47c6
SHA256

a7c1a93e270531b4a61c0d7be268854c95da833a8ee3f58f517e76dace84d1ba
SHA512

581a24dd9b0e4c46570c75515a11c06129c0ee4892f59cbf153a319e3717bbc5a0c004e466a7725a883ac824e84db1af9562e8a4d7e5c36f44ab5e12106dd2a9
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlxub9Aq:b/yC4GyNM01GuQMNXw2PSjHPbSuYl0yq

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2652	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
2108	2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2108	2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe
2652	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2652	2108	2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe	28
PID 2108 wrote to memory of 2652	2108	2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe	28
PID 2108 wrote to memory of 2652	2108	2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe	28
PID 2108 wrote to memory of 2652	2108	2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_b3f8a74425b34dfa6e9187e9a0696ce5_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:2652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
38KB

MD5
1b32af568e8aa30b8949999e103df6bc

SHA1
8c3bef330dbc83839fa871dc19e3596f2122e5b7

SHA256
7404d64896b8cb5110d40247bb66cb88bcf69667b2679bae2d611381250b4a68

SHA512
66530e8685084d7fffa82fd6d397b3ac08b8a6c9f8b9333aa0262e9de16c79101102ceaf9c19044e849cce07fe5bb8b1cef62743f5d5de37d0ba8849a8b02e98

Download Submit
memory/2108-0-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2108-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2108-1-0x0000000001CE0000-0x0000000001CE6000-memory.dmp

Filesize
24KB

Download
memory/2652-16-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download