Analysis
-
max time kernel
11s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
08/03/2024, 16:25
Static task
static1
Behavioral task
behavioral1
Sample
2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe
-
Size
35KB
-
MD5
46048bb31e31066222bc6a738678a55c
-
SHA1
a4174fd4747f7513a7046fa227c96e9cfbf251d6
-
SHA256
e3c956a1bac7939afa95dbe3c61cac4696b936af61ebe3212988997e5576e1dc
-
SHA512
7120edb610c7d21d30ccf27178299702b9326f7c68d1e8f3081db86948c4ff4022f71234225746336745e58d7da94e2f8772f79b1e4e5a4e13ee90fc87129de9
-
SSDEEP
384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSzn1KkZQYFxG:b/yC4GyNM01GuQMNXw2PSj1POaG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012257-10.dat CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 2612 retln.exe -
Loads dropped DLL 1 IoCs
pid Process 2012 2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
pid Process 2012 2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe 2612 retln.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2012 wrote to memory of 2612 2012 2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe 28 PID 2012 wrote to memory of 2612 2012 2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe 28 PID 2012 wrote to memory of 2612 2012 2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe 28 PID 2012 wrote to memory of 2612 2012 2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-08_46048bb31e31066222bc6a738678a55c_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\retln.exe"C:\Users\Admin\AppData\Local\Temp\retln.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2612
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD585d8725dca9f454c23378205c242cc86
SHA1b11d4ff6b09293c253bdd2f93c02fa715dbe9914
SHA256f33dbc74267a749b1c1e294c1060bdbbf04afa7a322e5a6b70244329f5700f72
SHA512eb034f1b63926ca17d18f3c74b0bbdd44aeff2607b41a4aae61ec577319856fe3db09b6d62893249798ed5fae3e3236b2b6e368962119c147747062984cc84c9