fc0d812e470236a5f650167a9ad8d6bef9f9ebd8e6ae4aab849666ecc15aba0a

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240419-en
resource tags

arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system
submitted
24/05/2024, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe
Size

43KB
MD5

0c461b7d4beb13e60ea75ce234aecc74
SHA1

0a1fc2a5fef5f4b47ce95a79390f9b910c26765b
SHA256

fc0d812e470236a5f650167a9ad8d6bef9f9ebd8e6ae4aab849666ecc15aba0a
SHA512

9fd7e66d13326cfb772e2f9dcfbbee39815d50669874124b475a0376247a89d7b28eaf948615e44598b70d362bec1443b1c09b86e812093863b4030864d48f58
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PA6:b/pYayGig5HjS3NPA6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x000b00000001228a-10.dat	CryptoLocker_rule2

Executes dropped EXE 1 IoCs

pid	Process
3028	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
1680	2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
1680	2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe
3028	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 3028	1680	2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe	28
PID 1680 wrote to memory of 3028	1680	2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe	28
PID 1680 wrote to memory of 3028	1680	2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe	28
PID 1680 wrote to memory of 3028	1680	2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe	28

C:\Users\Admin\AppData\Local\Temp\2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-24_0c461b7d4beb13e60ea75ce234aecc74_cryptolocker.exe"
1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of UnmapMainImage
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
43KB

MD5
a84c76b126ffc7bb33cb8c4bf9e626c2

SHA1
4acc49e1d654360e21a0d3c08f72c9497fa645e3

SHA256
47357ec2b4cdce7a854b2ddfc58f87c8af299d8912ed62de40aaffc0939db491

SHA512
5b41116640c19be622279591c923175d65617c0dab0885834d76e9aeb324c56df0ebae3edaaf67ba7fbb58279ba666c55b451835863a5d01a4605e0bdeec1c18

Download Submit
memory/1680-0-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/1680-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1680-8-0x0000000000280000-0x0000000000286000-memory.dmp

Filesize
24KB

Download
memory/3028-23-0x0000000000300000-0x0000000000306000-memory.dmp

Filesize
24KB

Download