f2f883c52f7993a9787c566f6ac3600b32da05e44ea0b908ab505170766d74b1

Analysis

max time kernel
152s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
26/01/2024, 08:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-26_241ba2c57e04e8ea0fe5cfd86a9ec5ed_cryptolocker.exe
Size

40KB
MD5

241ba2c57e04e8ea0fe5cfd86a9ec5ed
SHA1

6209bd345f0371dd9c84ee0ead1bea1fab76487b
SHA256

f2f883c52f7993a9787c566f6ac3600b32da05e44ea0b908ab505170766d74b1
SHA512

39fe369256c5dc7a92c14f7e2646df54670d813fdd16ee73f7cc9fd0c4fd6c0be2b38552eba3383bfc79387286cb7b0189965c11b91ff8b909cd6100153ca842
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAI:b/pYayGig5HjS3NPAI

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001e2b4-13.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	2024-01-26_241ba2c57e04e8ea0fe5cfd86a9ec5ed_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
1896	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 1896	4932	2024-01-26_241ba2c57e04e8ea0fe5cfd86a9ec5ed_cryptolocker.exe	89
PID 4932 wrote to memory of 1896	4932	2024-01-26_241ba2c57e04e8ea0fe5cfd86a9ec5ed_cryptolocker.exe	89
PID 4932 wrote to memory of 1896	4932	2024-01-26_241ba2c57e04e8ea0fe5cfd86a9ec5ed_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-01-26_241ba2c57e04e8ea0fe5cfd86a9ec5ed_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-26_241ba2c57e04e8ea0fe5cfd86a9ec5ed_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:1896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
40KB

MD5
249e34d56e1f215d32a7b210636f3545

SHA1
2c6d5c4f8a9ada1e7fb335aa72221d34474cba0a

SHA256
ba7a50e2add4ff7f9c09b2b490288c0594f0f9d05e1befbadfcded095d99fd00

SHA512
1347445cd990a346c23dac12963f49e2c024356e404ff287ed1536f545adf5f301e19ad33045908a87e2ca31a0a505ab6946853e8af288ea7bb5a5720a1ed2c4

Download Submit
memory/1896-21-0x0000000002210000-0x0000000002216000-memory.dmp

Filesize
24KB

Download
memory/4932-0-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/4932-1-0x00000000021E0000-0x00000000021E6000-memory.dmp

Filesize
24KB

Download
memory/4932-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download