d2fb1a19451ebbd1693411519a1524f53bc4859b25ac30455da76de8409909d5

Analysis

max time kernel
11s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
15/10/2024, 05:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe
Size

44KB
MD5

d3774e1feda2464599713047d6eba9c6
SHA1

41ef8a24bd925ee65b225a883edcbcc84ca98210
SHA256

d2fb1a19451ebbd1693411519a1524f53bc4859b25ac30455da76de8409909d5
SHA512

80c2fbc943625b1867cbc9e01f933a270947a3fc6550366e33b255b3878d774062fa974bfcc11c33bf004e410a16b975a87210c3e1c4ba703949fa03922f96d4
SSDEEP

768:bQyC4GyNM01GuQMNXwXOQ69zbjlAAX5e9z8V:bQpYayGiAizbR9XwzU

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2876	retln.exe

Loads dropped DLL 1 IoCs

pid	Process
2640	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe

Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	retln.exe

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2640	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe
2876	retln.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2640 wrote to memory of 2876	2640	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe	30
PID 2640 wrote to memory of 2876	2640	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe	30
PID 2640 wrote to memory of 2876	2640	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe	30
PID 2640 wrote to memory of 2876	2640	2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe	30

C:\Users\Admin\AppData\Local\Temp\2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-10-15_d3774e1feda2464599713047d6eba9c6_cryptolocker.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2640
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of UnmapMainImage
  PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Network Service Discovery

T1046

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
44KB

MD5
ce691dbf53b750efa849d95f99024167

SHA1
88a51e8268345372c08da4fcd23ab4e9a1526e6a

SHA256
ffddf14cc3324fcdea7c585709ebdb3065aa8700714c57bac7b16e8547bbe36a

SHA512
06b748fc57178f5bc88e03865a144a99391ee1e5bb83bf17b9922f1f3eadc53940bebb9fce4a63cc8217915168e74f34bcffcddb279a038a352b20c5053f9749

Download Submit
memory/2640-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2640-8-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2640-0-0x0000000000290000-0x0000000000296000-memory.dmp

Filesize
24KB

Download
memory/2876-23-0x00000000003F0000-0x00000000003F6000-memory.dmp

Filesize
24KB

Download