c1e9b967296cb954c1cd34de10993f81a7d8726c1e3314cf66ae49703a0a30aa

Analysis

max time kernel
15s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
07/09/2024, 02:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe
Size

32KB
MD5

f3516444e2415804e31e1a5c6365ce89
SHA1

50e231f71a8923e4f120b32195e6ba2f65e38e5d
SHA256

c1e9b967296cb954c1cd34de10993f81a7d8726c1e3314cf66ae49703a0a30aa
SHA512

ff99375469170b7b86bf35ead3d235f6c01d2ec4c4c3873f7ed0894be63b8d4ac3784cdc9606029052e4d2f354222af034a76bbc07202b03c789557bf9006b73
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zznum+U8Ss87vhicc:b/yC4GyNM01GuQMNXum+NSnicc

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2940	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
2180	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	retln.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2180	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe
2940	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 2940	2180	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe	30
PID 2180 wrote to memory of 2940	2180	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe	30
PID 2180 wrote to memory of 2940	2180	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe	30
PID 2180 wrote to memory of 2940	2180	2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-09-07_f3516444e2415804e31e1a5c6365ce89_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
32KB

MD5
b417dd39fb85a3512cd467478bc931d8

SHA1
f4f70676210cdd8173d0543f8abd1863d6846b1b

SHA256
af23d8cdb3c79030622fe9ab287017963093c9168b83d5b66962576c15460f95

SHA512
916b11efef82b76c59f632e3a5b21c0044a020e0e42aa9c374c359c0321dedc65f040524c26636fbf7df36231bf9fac935a236a18d609bb6d452666c7e4cb4d4

Download Submit
memory/2180-8-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2180-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2180-0-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download
memory/2940-23-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download