Analysis
-
max time kernel
10s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29/05/2024, 04:45
Static task
static1
Behavioral task
behavioral1
Sample
2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe
-
Size
38KB
-
MD5
fd27d1c2255f519149005392ba674614
-
SHA1
30ed53bec1ccfef9caca36bf00e83a090dce2581
-
SHA256
0379fbd4eb8e3fc7aafaf5107f6763395632d1f5cce1137fe337391a7216e15d
-
SHA512
942bce9e156662d9bd8e14c72ab66ce1100090ab76e1efbcc73f233eca03dc42db1a4db9f8792883549d73ef56b0ba8d2c77c17bfbe14bd47f251dd7314b3b3a
-
SSDEEP
384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/EIjxuaPlbd:b/yC4GyNM01GuQMNXw2PSjH+PPxVb
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral1/files/0x000b000000015ccd-10.dat CryptoLocker_rule2 -
Executes dropped EXE 1 IoCs
pid Process 2792 retln.exe -
Loads dropped DLL 1 IoCs
pid Process 1196 2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of UnmapMainImage 2 IoCs
pid Process 1196 2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe 2792 retln.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1196 wrote to memory of 2792 1196 2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe 28 PID 1196 wrote to memory of 2792 1196 2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe 28 PID 1196 wrote to memory of 2792 1196 2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe 28 PID 1196 wrote to memory of 2792 1196 2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe"1⤵
- Loads dropped DLL
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Users\Admin\AppData\Local\Temp\retln.exe"C:\Users\Admin\AppData\Local\Temp\retln.exe"2⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
PID:2792
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
38KB
MD575a2af09e1a121023958fb7f2fa16bc5
SHA187f503ceb9d2dd9a6367f229989dc267bf86b9c9
SHA25609378c3e117ff686126851b63a6f860e75f9aa77f43b9e8a68ded06f2e8f1daf
SHA5121bbbdd69d6d9126fa520965a6194dd5a6ac0a947d72e74e334dc52e1b164cf36eac542fc05c80a311c93e913c59bb8284a11855343180033aea0869a5a01b281