79a3e54f5dd4cf3814037d810775012d4e7deac901dceaf73326a4ccdf791ca9

Analysis

max time kernel
155s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-01-25_8c6af9cc4670d1d1eb049d64e092e437_cryptolocker.exe
Size

40KB
MD5

8c6af9cc4670d1d1eb049d64e092e437
SHA1

54c0c69c707bf90b3dce4be09a90144d191f4c7e
SHA256

79a3e54f5dd4cf3814037d810775012d4e7deac901dceaf73326a4ccdf791ca9
SHA512

528e71c2137e1b2eff8cd61206883d0878b2a41334add97a437405b399902ed2ceb8f05bd56ab5d6f985bbdc6c62e22ec400406a73719bb0ce81a25b5c85653e
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAF:b/pYayGig5HjS3NPAF

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000022480-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-25_8c6af9cc4670d1d1eb049d64e092e437_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
5016	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4224 wrote to memory of 5016	4224	2024-01-25_8c6af9cc4670d1d1eb049d64e092e437_cryptolocker.exe	88
PID 4224 wrote to memory of 5016	4224	2024-01-25_8c6af9cc4670d1d1eb049d64e092e437_cryptolocker.exe	88
PID 4224 wrote to memory of 5016	4224	2024-01-25_8c6af9cc4670d1d1eb049d64e092e437_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-25_8c6af9cc4670d1d1eb049d64e092e437_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-25_8c6af9cc4670d1d1eb049d64e092e437_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4224
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:5016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
40KB

MD5
e8ef9dd17cd924907dcb0ba007dea753

SHA1
41a66f9165eba772cbb6efe6e41124fef8abbc67

SHA256
40df330c966e5fbfc4fc607895ef94ea82611a9e191e62e3bf47ad8387f6ae39

SHA512
9fbcb3214011801518df814deb3ff346e776e107860cabe6ff9acc45158d90a9f9a8487e21f12bcdaa70d397e4b6008215c7e0f02b4a17cd996069b7e86f13c4

Download Submit
memory/4224-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4224-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4224-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/5016-20-0x00000000005D0000-0x00000000005D6000-memory.dmp

Filesize
24KB

Download