332a9f9e03fc8bcd5b0fff937505097b5e19974c326424dad7a27e0090976541

Analysis

max time kernel
120s
max time network
125s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:38

Target

2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe
Size

44KB
MD5

704f3898b15f5fd082547d5463d30956
SHA1

5be1cc9361dd32b2ba4fefcd80d0c90993777437
SHA256

332a9f9e03fc8bcd5b0fff937505097b5e19974c326424dad7a27e0090976541
SHA512

72fc74a989a1b9512cb59efb011fba93e95257ef08c9f2cab3d78af7f396ab5e2e4b5edb9c23396b3dd3cfa18faaf835ae9b396ad0d5d88fae779b550b1186b1
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PA4DwOoJ8:b/pYayGig5HjS3NPAuwfO

Score

9^/10

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

2944 retln.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe

pid process

2492 2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exeretln.exe

pid process

2492 2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe
2944 retln.exe

pid	process
2944	retln.exe

pid	process
2492	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe

pid	process
2492	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe
2944	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe

description	pid	process	target process
PID 2492 wrote to memory of 2944	2492	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe	retln.exe
PID 2492 wrote to memory of 2944	2492	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe	retln.exe
PID 2492 wrote to memory of 2944	2492	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe	retln.exe
PID 2492 wrote to memory of 2944	2492	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe	retln.exe

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

\Users\Admin\AppData\Local\Temp\retln.exe
Filesize
44KB

MD5
0fe61a2623d987d4e5b2378ac578d7d4

SHA1
3d2707629104ae721ba27b3928ccc08bd21f2688

SHA256
7f4a527e986250d7e83dd801e8d20eb6d476ad461c3f5aa5814d96ebb8d3f467

SHA512
b53a0d7d69c86c3c04dff3bb1a4f52461f8ac309abfcfb9c5d5d72fb306da2b4cd6108a994ddca4abe20b32a47b581ef8f2ffd568e03b2b660a250038051ecd3

Download Submit
memory/2492-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2492-0-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2492-8-0x0000000000270000-0x0000000000276000-memory.dmp

Filesize
24KB

Download
memory/2944-23-0x0000000000360000-0x0000000000366000-memory.dmp

Filesize
24KB

Download