19b2026744798614a4ea2cb2e0e31c72b06eafd79fee841b4edbdb978aaf5d37

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 07:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2024-04-22_008dcb3820e5338cc22ce85298d5d78a_cryptolocker.exe
Size

42KB
MD5

008dcb3820e5338cc22ce85298d5d78a
SHA1

ce25f63d64df033be0313e9c5e1430ddc436a325
SHA256

19b2026744798614a4ea2cb2e0e31c72b06eafd79fee841b4edbdb978aaf5d37
SHA512

8b905031cf621afdddd24d8723b63e45e02b65ff1daab7b1a9d052ca4152b380fb2cc055af1a8d170c1e3d1b1e1131efa88e276f10c4ee9eb1b3424fbc946953
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAR:b/pYayGig5HjS3NPAR

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x000300000001e97c-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355664440-2199602304-1223909400-1000\Control Panel\International\Geo\Nation	2024-04-22_008dcb3820e5338cc22ce85298d5d78a_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
864	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 864	4804	2024-04-22_008dcb3820e5338cc22ce85298d5d78a_cryptolocker.exe	84
PID 4804 wrote to memory of 864	4804	2024-04-22_008dcb3820e5338cc22ce85298d5d78a_cryptolocker.exe	84
PID 4804 wrote to memory of 864	4804	2024-04-22_008dcb3820e5338cc22ce85298d5d78a_cryptolocker.exe	84

C:\Users\Admin\AppData\Local\Temp\2024-04-22_008dcb3820e5338cc22ce85298d5d78a_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-22_008dcb3820e5338cc22ce85298d5d78a_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
42KB

MD5
6894645316a79fdb2ec9227f13b89e63

SHA1
eae66adbf02b3665f90bbb8e1a19f6e8d05f386e

SHA256
fab53f2ac1bbb5f05558fff7aba9fa0d7c019a04d1e0117a5a358e522eb4cc13

SHA512
b5416581dacec4a88d6cdd128dec188a9b0e666cacfeea4a20dd5d34c9b2592462de959ddd0e8a89a63e206fa1d9363451e37a0b45869a57fb2293061842fd70

Download Submit
memory/864-25-0x0000000000500000-0x0000000000506000-memory.dmp

Filesize
24KB

Download
memory/4804-0-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4804-1-0x0000000002350000-0x0000000002356000-memory.dmp

Filesize
24KB

Download
memory/4804-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download