1004f68c89a2cb8d3f493fb95e715ba97a2098dfd7197fc42e2411036ca5b423

Analysis

max time kernel
14s
max time network
118s
platform
windows7_x64
resource
win7-20240220-en
resource tags

arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
submitted
26/03/2024, 22:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe
Size

35KB
MD5

2b687ac6fa5a01ee19cdfec493f0c223
SHA1

95cc577540535846c00c9167d07d4991908ee3e1
SHA256

1004f68c89a2cb8d3f493fb95e715ba97a2098dfd7197fc42e2411036ca5b423
SHA512

96a3f83ebf3b81cbf5a65c1f98fc09e0b727b060c63fa1b4d6ec64c6651e50c4038c1f2be4c84fd530a66553e5f0d216e5f51351b919a258b90159d2b9e55918
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/EIjNcsUJ7I:b/yC4GyNM01GuQMNXw2PSjH+PPNcsh

Score

9^/10

discovery

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000c000000012339-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
1720	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
3068	2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
3068	2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe
1720	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3068 wrote to memory of 1720	3068	2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe	28
PID 3068 wrote to memory of 1720	3068	2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe	28
PID 3068 wrote to memory of 1720	3068	2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe	28
PID 3068 wrote to memory of 1720	3068	2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-26_2b687ac6fa5a01ee19cdfec493f0c223_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3068
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:1720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
35KB

MD5
2d4135f64b688921a1fcd8e31391f019

SHA1
590346ff8f30b7c8e8ca5d55c210d2ae03b1a0f9

SHA256
bcfefe24b2258a3e2546983aa224145da2a09596a02cb9c11f9053f684ae910a

SHA512
5b0f648cea7f8bbd28d0d147420be7eb8226bfcb5a306babb68fe42bc4266ac5b120fdce9546f1d479e426d328c35c73609274aa71dd0c651ed9cf6e38891684

Download Submit
memory/1720-23-0x0000000000390000-0x0000000000396000-memory.dmp

Filesize
24KB

Download
memory/3068-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/3068-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3068-8-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download