Analysis

  • max time kernel
    11s
  • max time network
    122s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    08/03/2024, 16:25

General

  • Target

    2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe

  • Size

    35KB

  • MD5

    46048bb31e31066222bc6a738678a55c

  • SHA1

    a4174fd4747f7513a7046fa227c96e9cfbf251d6

  • SHA256

    e3c956a1bac7939afa95dbe3c61cac4696b936af61ebe3212988997e5576e1dc

  • SHA512

    7120edb610c7d21d30ccf27178299702b9326f7c68d1e8f3081db86948c4ff4022f71234225746336745e58d7da94e2f8772f79b1e4e5a4e13ee90fc87129de9

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSzn1KkZQYFxG:b/yC4GyNM01GuQMNXw2PSj1POaG

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:2012
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2612

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\retln.exe

    Filesize

    35KB

    MD5

    85d8725dca9f454c23378205c242cc86

    SHA1

    b11d4ff6b09293c253bdd2f93c02fa715dbe9914

    SHA256

    f33dbc74267a749b1c1e294c1060bdbbf04afa7a322e5a6b70244329f5700f72

    SHA512

    eb034f1b63926ca17d18f3c74b0bbdd44aeff2607b41a4aae61ec577319856fe3db09b6d62893249798ed5fae3e3236b2b6e368962119c147747062984cc84c9

  • memory/2012-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/2012-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/2012-4-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/2612-19-0x0000000000380000-0x0000000000386000-memory.dmp

    Filesize

    24KB