Analysis

  • max time kernel
    10s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    29/05/2024, 04:45

General

  • Target

    2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe

  • Size

    38KB

  • MD5

    fd27d1c2255f519149005392ba674614

  • SHA1

    30ed53bec1ccfef9caca36bf00e83a090dce2581

  • SHA256

    0379fbd4eb8e3fc7aafaf5107f6763395632d1f5cce1137fe337391a7216e15d

  • SHA512

    942bce9e156662d9bd8e14c72ab66ce1100090ab76e1efbcc73f233eca03dc42db1a4db9f8792883549d73ef56b0ba8d2c77c17bfbe14bd47f251dd7314b3b3a

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/EIjxuaPlbd:b/yC4GyNM01GuQMNXw2PSjH+PPxVb

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Creates a large amount of network flows 1 TTPs

    This may indicate a network scan to discover remotely running services.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of UnmapMainImage 2 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-29_fd27d1c2255f519149005392ba674614_cryptolocker.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1196
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of UnmapMainImage
      PID:2792

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\retln.exe

    Filesize

    38KB

    MD5

    75a2af09e1a121023958fb7f2fa16bc5

    SHA1

    87f503ceb9d2dd9a6367f229989dc267bf86b9c9

    SHA256

    09378c3e117ff686126851b63a6f860e75f9aa77f43b9e8a68ded06f2e8f1daf

    SHA512

    1bbbdd69d6d9126fa520965a6194dd5a6ac0a947d72e74e334dc52e1b164cf36eac542fc05c80a311c93e913c59bb8284a11855343180033aea0869a5a01b281

  • memory/1196-0-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/1196-1-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/1196-8-0x00000000003E0000-0x00000000003E6000-memory.dmp

    Filesize

    24KB

  • memory/2792-23-0x0000000000280000-0x0000000000286000-memory.dmp

    Filesize

    24KB