6c507b68f662e45c24ab93a48f6822f7ecb2b13f4748cc6138e1825b7799edd6

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 04:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-03_151c3e8e14c8aee4818ba17ffd04c6fb_cryptolocker.exe
Size

33KB
MD5

151c3e8e14c8aee4818ba17ffd04c6fb
SHA1

eb2e917fe0d7a8048725ab8baf3950906c16d688
SHA256

6c507b68f662e45c24ab93a48f6822f7ecb2b13f4748cc6138e1825b7799edd6
SHA512

2cb5e5d99c7f7fe1429170f2e4c09499dcd46cba8408fc9a6d0ae3b6b0bc098bc777a8ffc1e826db8070b8a2733b792b0fba9fbf01f46ba2e31a08b69a40ce23
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzu02lOQA6:b/yC4GyNM01GuQMNXw2PSjHC02ltA6

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231ff-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation	2024-02-03_151c3e8e14c8aee4818ba17ffd04c6fb_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3384	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3384	4972	2024-02-03_151c3e8e14c8aee4818ba17ffd04c6fb_cryptolocker.exe	89
PID 4972 wrote to memory of 3384	4972	2024-02-03_151c3e8e14c8aee4818ba17ffd04c6fb_cryptolocker.exe	89
PID 4972 wrote to memory of 3384	4972	2024-02-03_151c3e8e14c8aee4818ba17ffd04c6fb_cryptolocker.exe	89

C:\Users\Admin\AppData\Local\Temp\2024-02-03_151c3e8e14c8aee4818ba17ffd04c6fb_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-02-03_151c3e8e14c8aee4818ba17ffd04c6fb_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
33KB

MD5
95e4eac0b21c82c7e0471599e2ac8904

SHA1
5a398a67e09b1e7b05f6e74a51c99c7b890a269d

SHA256
d86fd1c3cda453d4120bd61e11754cfe891798378361fce82e74e9c2d5d5255a

SHA512
c02a80201abbbb2bcda08530b445f6e93e2c82b4204d4245c660b1f7d47b92b75a418f25806a0bc7d1db47c8d8339f6660b7579d0779bb593fcb465ae0ecf1f4

Download Submit
memory/3384-20-0x0000000002190000-0x0000000002196000-memory.dmp

Filesize
24KB

Download
memory/4972-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4972-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4972-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download