fb8055ca6363e8a3a016fb7edf37c7ed10b4b8ebe0603fc5eecba1eee77eca19

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
27-01-2024 15:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-01-27_b153682dfbb42b0be2a625c4926a64d2_cryptolocker.exe
Size

33KB
MD5

b153682dfbb42b0be2a625c4926a64d2
SHA1

c2f552021557f9a732b74f7e1fa383e98e69ad42
SHA256

fb8055ca6363e8a3a016fb7edf37c7ed10b4b8ebe0603fc5eecba1eee77eca19
SHA512

8f04594dfd2f26f943babb49724422884539937d0a1a96559b21b2bfc8a79169548cc295406ccc8a7c9297d4c950712a6734696bcc153163cd9d63efe1abc48b
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6A0X/EI1:b/yC4GyNM01GuQMNXw2PSjH+PJ

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000600000002322d-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1815711207-1844170477-3539718864-1000\Control Panel\International\Geo\Nation	2024-01-27_b153682dfbb42b0be2a625c4926a64d2_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3852	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 3852	3240	2024-01-27_b153682dfbb42b0be2a625c4926a64d2_cryptolocker.exe	88
PID 3240 wrote to memory of 3852	3240	2024-01-27_b153682dfbb42b0be2a625c4926a64d2_cryptolocker.exe	88
PID 3240 wrote to memory of 3852	3240	2024-01-27_b153682dfbb42b0be2a625c4926a64d2_cryptolocker.exe	88

C:\Users\Admin\AppData\Local\Temp\2024-01-27_b153682dfbb42b0be2a625c4926a64d2_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-01-27_b153682dfbb42b0be2a625c4926a64d2_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:3852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
33KB

MD5
c9930373fcec9e224b21410d6537d04c

SHA1
94a5f6ebe21ec29e90738980035aedb618f23c51

SHA256
25f826f2a51ee42ac6f365d2b1335d27df234e6262abfc7d718272fd1162c15c

SHA512
611dd2f69e8b4d77c513d5ded5b19053aa125c9fd21b4dca5eefe853363fdda2d9b722d22ddccc1b7b63d195d610d95b8e37522b354a10641ee11dc21fdff3ce

Download Submit
memory/3240-0-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/3240-1-0x0000000002230000-0x0000000002236000-memory.dmp

Filesize
24KB

Download
memory/3240-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3852-20-0x0000000002110000-0x0000000002116000-memory.dmp

Filesize
24KB

Download