Overview

overview

10

Static

static

10

2024-05-22...er.exe

windows7-x64

9

2024-05-22...er.exe

windows10-2004-x64

9

Analysis

  • max time kernel
    17s
  • max time network
    118s
  • platform
    windows7_x64
  • resource
    win7-20231129-en
  • resource tags

    arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
  • submitted
    22-05-2024 02:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-05-22_22649df334759e7a643e262d096ddb8c_cryptolocker.exe

  • Size

    44KB

  • MD5

    22649df334759e7a643e262d096ddb8c

  • SHA1

    9fc93bd59703c48b75229386e7bc17d7576af28f

  • SHA256

    deb383b85841d693970bdb57a8f3512958526727cab3c5ff6a413f3fa1415721

  • SHA512

    2512e8d5c00b00bd87aed74faa3da28540992a37259940d9894bb387e95e359e494bce53b9863bc2d73cfafd3e28b1d114170c2604376d37db980710cb9b2ded

  • SSDEEP

    768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PA4DwOoJR:b/pYayGig5HjS3NPAuwf/

Score
9/10
discovery

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-22_22649df334759e7a643e262d096ddb8c_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-22_22649df334759e7a643e262d096ddb8c_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:624
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2000

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

1
T1046

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\retln.exe
    Filesize

    44KB

    MD5

    4a6b1dd3e97767a1f58cf78138fa7c71

    SHA1

    4f09c9d1e58386e4b564811359ed3665d754b16f

    SHA256

    b38894a95457d00a662165ec556330caa461ce24a6dfbeb2733655da14bbaffc

    SHA512

    4c127cad5d1fc92e652cdd101e7ddf376c2126af60c7d532bca447726534e59bbb12b1198ce37e2ce7d84032705699f52cc79228581d9e9166fb0a09da3c4736

    Download Submit
  • memory/624-0-0x0000000000280000-0x0000000000286000-memory.dmp
    Filesize

    24KB

    Download
  • memory/624-1-0x0000000000280000-0x0000000000286000-memory.dmp
    Filesize

    24KB

    Download
  • memory/624-2-0x0000000000400000-0x0000000000406000-memory.dmp
    Filesize

    24KB

    Download
  • memory/2000-23-0x0000000000350000-0x0000000000356000-memory.dmp
    Filesize

    24KB

    Download