b92aae38718bca984d2b11abc7dd6a1eed50b7dda5141ef14b5e64e42df5ab2a

Analysis

max time kernel
210s
max time network
220s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11-01-2024 05:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-10_0371bc7e03cb5d3b2394db8807657a65_cryptolocker.exe
Size

33KB
MD5

0371bc7e03cb5d3b2394db8807657a65
SHA1

ede1e275a06bc80e27129cfa7f334fe79f13bdce
SHA256

b92aae38718bca984d2b11abc7dd6a1eed50b7dda5141ef14b5e64e42df5ab2a
SHA512

d18c8f833f4567292882ab6d613e96e6e8cdd691625fb05b66df24427b4e496e61eef6613fbec27872e5b3d2c47a4d28c47d35423a5f9858460fb753379e5c8c
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznStwIoIQ+dHd9PRc+H:b/yC4GyNM01GuQMNXw2PSjS2uvdHd9lH

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-635608581-3370340891-292606865-1000\Control Panel\International\Geo\Nation	2024-01-10_0371bc7e03cb5d3b2394db8807657a65_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1296	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3108 wrote to memory of 1296	3108	2024-01-10_0371bc7e03cb5d3b2394db8807657a65_cryptolocker.exe	92
PID 3108 wrote to memory of 1296	3108	2024-01-10_0371bc7e03cb5d3b2394db8807657a65_cryptolocker.exe	92
PID 3108 wrote to memory of 1296	3108	2024-01-10_0371bc7e03cb5d3b2394db8807657a65_cryptolocker.exe	92

C:\Users\Admin\AppData\Local\Temp\2024-01-10_0371bc7e03cb5d3b2394db8807657a65_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-10_0371bc7e03cb5d3b2394db8807657a65_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3108
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
33KB

MD5
f0b41e87c59113391a7dd16b25a9ccb8

SHA1
c7b2e3edfd424ac674263ba7d46a8bce2289159f

SHA256
95fb0c51c5ba6493f997537235e6d39545e1e436d83c4ae2d3d7350e0a84510d

SHA512
cd3ffb4e274598e527a1180a0cf50ca1fff73b545958c38bcf2f53b5a63f0eaf4f9146140084d8ab199e8fc5b212a283aed6f4126ccca067a2cd7c9f2fbf5b44

Download Submit
memory/1296-22-0x0000000000590000-0x0000000000596000-memory.dmp

Filesize
24KB

Download
memory/3108-0-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/3108-1-0x00000000022C0000-0x00000000022C6000-memory.dmp

Filesize
24KB

Download
memory/3108-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download