Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
12-02-2024 17:49
Static task
static1
Behavioral task
behavioral1
Sample
2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe
Resource
win10v2004-20231215-en
General
-
Target
2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe
-
Size
30KB
-
MD5
c26ac7ed16a16a37da5b95ae01413d43
-
SHA1
c752559f896eccfeba95f09a1cdac14cdb70360f
-
SHA256
f476d333754a58c4a70a0b521d8c0e64a3a61f444aae5598a871a38c51f44ffb
-
SHA512
8e135f9cc72b7a81ba71671dc77a5df3b1706aead09d1662534fda17ae3dbb4636d8f38047d91c11fbca9fac0dc265ad619412bb34ebeb73257564ae43db2e22
-
SSDEEP
384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSzn8YS:b/yC4GyNM01GuQMNXw2PSjW
Malware Config
Signatures
-
Detection of CryptoLocker Variants 1 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\retln.exe CryptoLocker_rule2 -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe -
Executes dropped EXE 1 IoCs
Processes:
retln.exepid process 3456 retln.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exedescription pid process target process PID 232 wrote to memory of 3456 232 2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe retln.exe PID 232 wrote to memory of 3456 232 2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe retln.exe PID 232 wrote to memory of 3456 232 2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe retln.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-02-12_c26ac7ed16a16a37da5b95ae01413d43_cryptolocker.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\retln.exe"C:\Users\Admin\AppData\Local\Temp\retln.exe"2⤵
- Executes dropped EXE
PID:3456
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
31KB
MD5db2a5e08bad3c44745644ce23758c4a2
SHA1ca8b08607595f09ac2d7c9aa693cecda09c2d5f2
SHA256a976a97b2e9af1ee322697e1fe71f8f926d17dc2be073493bb43e799a6926518
SHA512e8dce39a76a71bfc1cc2474995ac3712e3d9935edf61c64a1f8ba9c4662a8c9dae1519033f229a3245f3cbfa59a379f150dbdc6f62c98a4465467927ad83b66b