7a65ded871499427f1a87ea3fe51a2e4ca051baf604dc2c03853e07324f66f3e

Analysis

max time kernel
153s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-10-2023 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2023-09-08_1088a72c4331c401e6a01272a9618f27_cryptolocker_JC.exe
Size

28KB
MD5

1088a72c4331c401e6a01272a9618f27
SHA1

2d5abf8a0263ac6ab69435eb70ce14c4f488fc89
SHA256

7a65ded871499427f1a87ea3fe51a2e4ca051baf604dc2c03853e07324f66f3e
SHA512

4788b44ab29f756c9d219c36b7e6373a0f5fb4ff6abf92ddee9f0722cbb872684042e9c19d39d4c7c5f2fa64ca8d9324b332b293e6cab180c4fe63558bd6107d
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznG:b/yC4GyNM01GuQMNXw2PSjG

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3811856890-180006922-3689258494-1000\Control Panel\International\Geo\Nation	NEAS.2023-09-08_1088a72c4331c401e6a01272a9618f27_cryptolocker_JC.exe

Executes dropped EXE 1 IoCs

pid	Process
4368	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4368	4820	NEAS.2023-09-08_1088a72c4331c401e6a01272a9618f27_cryptolocker_JC.exe	89
PID 4820 wrote to memory of 4368	4820	NEAS.2023-09-08_1088a72c4331c401e6a01272a9618f27_cryptolocker_JC.exe	89
PID 4820 wrote to memory of 4368	4820	NEAS.2023-09-08_1088a72c4331c401e6a01272a9618f27_cryptolocker_JC.exe	89

C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_1088a72c4331c401e6a01272a9618f27_cryptolocker_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2023-09-08_1088a72c4331c401e6a01272a9618f27_cryptolocker_JC.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:4368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
29KB

MD5
5046369ff0421a207f197b0d8d5f9e02

SHA1
3ce5ea9fd68f657befebe1381f751e3c1ddedbfb

SHA256
890b824c900aede511e136c1b98df1cdc9999ed940241dc799829b04998e2f84

SHA512
ab4430527cf979ec88cf3f83575d52cf9e9baffc554584323321e1dc080bf4a5a5a0d349d1d458170505b41a08e8c4fa49d93783ea9fb97ac79f907de715dd18

Download Submit
C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
29KB

MD5
5046369ff0421a207f197b0d8d5f9e02

SHA1
3ce5ea9fd68f657befebe1381f751e3c1ddedbfb

SHA256
890b824c900aede511e136c1b98df1cdc9999ed940241dc799829b04998e2f84

SHA512
ab4430527cf979ec88cf3f83575d52cf9e9baffc554584323321e1dc080bf4a5a5a0d349d1d458170505b41a08e8c4fa49d93783ea9fb97ac79f907de715dd18

Download Submit
C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
29KB

MD5
5046369ff0421a207f197b0d8d5f9e02

SHA1
3ce5ea9fd68f657befebe1381f751e3c1ddedbfb

SHA256
890b824c900aede511e136c1b98df1cdc9999ed940241dc799829b04998e2f84

SHA512
ab4430527cf979ec88cf3f83575d52cf9e9baffc554584323321e1dc080bf4a5a5a0d349d1d458170505b41a08e8c4fa49d93783ea9fb97ac79f907de715dd18

Download Submit
memory/4368-20-0x00000000020A0000-0x00000000020A6000-memory.dmp

Filesize
24KB

Download
memory/4820-0-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/4820-1-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/4820-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download