Analysis
-
max time kernel
9s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
22-05-2024 02:54
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe
-
Size
43KB
-
MD5
fc13dd18936b2701de0933d767d01a8f
-
SHA1
57ac0ac482fa5bce959731366f9bd1c0c4cecdd1
-
SHA256
30803504b700ed9ae4234c952f5e548ba6e77621d0a174d1e8c9092233d0aba4
-
SHA512
ad4cc03c75cf5606e0833f26dc9e27e42cee01eaf3c502bad990b9c86bed90dd8c95e1ddd2c96e073682f0083529db76aa4cfe861eda42f9a19d2308f9790257
-
SSDEEP
768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAl:b/pYayGig5HjS3NPAl
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\retln.exe CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
Processes:
retln.exepid process 2932 retln.exe -
Loads dropped DLL 1 IoCs
Processes:
2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exepid process 3016 2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
Processes:
2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exeretln.exepid process 3016 2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe 2932 retln.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exedescription pid process target process PID 3016 wrote to memory of 2932 3016 2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe retln.exe PID 3016 wrote to memory of 2932 3016 2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe retln.exe PID 3016 wrote to memory of 2932 3016 2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe retln.exe PID 3016 wrote to memory of 2932 3016 2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe retln.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-22_fc13dd18936b2701de0933d767d01a8f_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\retln.exe"C:\Users\Admin\AppData\Local\Temp\retln.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\retln.exeFilesize
43KB
MD54952479f94e195dd60c9f3ea15815316
SHA1847ce88897ed4c4391bb0d8fa6a248564af295dc
SHA256c955f42fe6ede93937b5321a39d97dbf411f085aff2cb9b2942c871d5b6783ed
SHA5122e8e34ab943aab7ab0ada6d491cedef77140f9bc2207abb24b5162cabc93dec7f42921072151f17d8b5b300c7276041355b2093cdb4b8f754324e7a64184d7a8
-
memory/2932-23-0x0000000000380000-0x0000000000386000-memory.dmpFilesize
24KB
-
memory/3016-0-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/3016-8-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/3016-1-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB