583a5315717318261c3563a11af539ea392a2b88a52bce6e93465a2919a67535

Analysis

max time kernel
165s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/01/2024, 12:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-06_9ec818c12aa6c48167beaec35fb60826_cryptolocker.exe
Size

38KB
MD5

9ec818c12aa6c48167beaec35fb60826
SHA1

7ebe54ffc9b54c341aeec40b5a0e8812b3dca253
SHA256

583a5315717318261c3563a11af539ea392a2b88a52bce6e93465a2919a67535
SHA512

99e208d048bc960dccd29ec2f577004f2570bf2772a38771be94a0e7d08621956e1bfccfc1930877b66887150414eb47a81c195437564a73e768306145ee0813
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlxub9zX:b/yC4GyNM01GuQMNXw2PSjHPbSuYl0p

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-06_9ec818c12aa6c48167beaec35fb60826_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
2636	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3196 wrote to memory of 2636	3196	2024-01-06_9ec818c12aa6c48167beaec35fb60826_cryptolocker.exe	94
PID 3196 wrote to memory of 2636	3196	2024-01-06_9ec818c12aa6c48167beaec35fb60826_cryptolocker.exe	94
PID 3196 wrote to memory of 2636	3196	2024-01-06_9ec818c12aa6c48167beaec35fb60826_cryptolocker.exe	94

C:\Users\Admin\AppData\Local\Temp\2024-01-06_9ec818c12aa6c48167beaec35fb60826_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-06_9ec818c12aa6c48167beaec35fb60826_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3196
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
38KB

MD5
c88c17880a8df435f709163a72c7c3ee

SHA1
b6ec00ba55763f75406950f6105214496d914272

SHA256
066c65079df9916efd8dc3a1a7ad90331054e1e937ac7fd4d7c7a460f37feaec

SHA512
11e662e44286233152186367a1d3ccdbe486183fa06fa3f371225dd4f71a087c208ff019af6eb5a66704836195cbb6eea4ea1148670178cfeb11727145fb4c82

Download Submit
memory/2636-21-0x0000000002D60000-0x0000000002D66000-memory.dmp

Filesize
24KB

Download
memory/3196-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3196-1-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/3196-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download