Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
25-01-2024 17:22
Static task
static1
Behavioral task
behavioral1
Sample
2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exe
Resource
win7-20231215-en
General
-
Target
2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exe
-
Size
31KB
-
MD5
09a134c8ae5e847477ea745935195a08
-
SHA1
ded0efbc9d2ae2f3d05d688de32396d094019d58
-
SHA256
c86b089a7a12ba0ca1f308b2935064677bf9927ea86cef916e29f185343dc3d7
-
SHA512
860ab67122bb4052f51026a7b1d4844722963ff4c1a9268651a9f6bf47fd80c22ecdba17ec02516dd0a6cc2e897785be11b2224d789c606fdfa6c1b5116b3a89
-
SSDEEP
384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznUsD3W:b/yC4GyNM01GuQMNXw2PSjZG
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\retln.exe CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3791175113-1062217823-1177695025-1000\Control Panel\International\Geo\Nation 2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exe -
Executes dropped EXE 1 IoCs
Processes:
retln.exepid process 3952 retln.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exedescription pid process target process PID 4480 wrote to memory of 3952 4480 2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exe retln.exe PID 4480 wrote to memory of 3952 4480 2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exe retln.exe PID 4480 wrote to memory of 3952 4480 2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exe retln.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-25_09a134c8ae5e847477ea745935195a08_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Users\Admin\AppData\Local\Temp\retln.exe"C:\Users\Admin\AppData\Local\Temp\retln.exe"2⤵
- Executes dropped EXE
PID:3952
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\retln.exeFilesize
31KB
MD5286771c2f7c0ea34454b64f1aac4eac9
SHA1f7ceaadd9f036cac2802283cdd1ea88bb7a7724a
SHA2567739dd43b909c7a896765f381146d37faab943de7922f5f904b44c0672ccb8ab
SHA512be9f50d35c188c58d80ed1bf3e4fc74a1b0c9aa66df407903f70da6c113456149465074c387dabb65432a9e01525c16b6e755eb720aec2da16e21d974d8d43c1
-
memory/3952-21-0x0000000002120000-0x0000000002126000-memory.dmpFilesize
24KB
-
memory/4480-0-0x0000000002210000-0x0000000002216000-memory.dmpFilesize
24KB
-
memory/4480-1-0x0000000002210000-0x0000000002216000-memory.dmpFilesize
24KB
-
memory/4480-2-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB