cfcd632752fe2aa676446f054756ac8ec0dd8eef4e39c0a2b9f89a92ee071ca7

Analysis

max time kernel
15s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
22-05-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe
Size

31KB
MD5

caedafbafa077f5caabae3bbaf013590
SHA1

a95e238469efb754b806e66dd97c8632f6ad66b1
SHA256

cfcd632752fe2aa676446f054756ac8ec0dd8eef4e39c0a2b9f89a92ee071ca7
SHA512

c6927e85289605e122322308bbd4c54ec6ba156ef4bc52d59f91a8d501cb3971d813688c4550fe5cfb522fb07d99091c95cf4a311d55cd3a5670be7117f5d78d
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zznum+U8Ss87vhf:b/yC4GyNM01GuQMNXum+NSnf

Score

9^/10

discovery

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

2052 retln.exe
Loads dropped DLL 1 IoCs

Processes:

2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe

pid process

2204 2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of UnmapMainImage 2 IoCs

Processes:

2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exeretln.exe

pid process

2204 2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe
2052 retln.exe

pid	process
2052	retln.exe

pid	process
2204	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe

pid	process
2204	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe
2052	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe

description	pid	process	target process
PID 2204 wrote to memory of 2052	2204	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe	retln.exe
PID 2204 wrote to memory of 2052	2204	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe	retln.exe
PID 2204 wrote to memory of 2052	2204	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe	retln.exe
PID 2204 wrote to memory of 2052	2204	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe	retln.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2204

C:\Users\Admin\AppData\Local\Temp\retln.exe
"C:\Users\Admin\AppData\Local\Temp\retln.exe"
2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2052

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe
Filesize
31KB

MD5
041da58062a3faa214bb894bdc7ed98e

SHA1
ff28848bbceed9c298865a53be96db72c3aba043

SHA256
38061aad79974af892ec23243585af7243695ef3394a2d5874965d3864fcb6b2

SHA512
5c5dd1397be2a309e5e74952bec9783642e19538113f22163a0e038639b45ca77c8be87e187482c0a3a3ee752e863b4b1514e7738bc5394ca6ae00edfdaeed2d

Download Submit
memory/2052-23-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/2204-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2204-8-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download
memory/2204-0-0x00000000003C0000-0x00000000003C6000-memory.dmp

Filesize
24KB

Download