1c981683977ddf7bc404944a5eb1d8fee61e0d648f7f90a085b2407e9583f3fe

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24-04-2024 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-24_589050ff71796e627ad29a8978dc38dc_cryptolocker.exe
Size

42KB
MD5

589050ff71796e627ad29a8978dc38dc
SHA1

6fa33516e7d5572b1ba8c51aba14571896d8cdc4
SHA256

1c981683977ddf7bc404944a5eb1d8fee61e0d648f7f90a085b2407e9583f3fe
SHA512

744c5f68073c88c58637810a4e708e19e4e0dab1598a8f5f9a8a186defd864798c1c9dbdfc07d90128d8482c3be18280489be9b9806bfa89aa2bd98560d8bf5b
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PAY:b/pYayGig5HjS3NPAY

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral2/files/0x0008000000023268-12.dat	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	2024-04-24_589050ff71796e627ad29a8978dc38dc_cryptolocker.exe

Executes dropped EXE 1 IoCs

pid	Process
3940	retln.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3940	3076	2024-04-24_589050ff71796e627ad29a8978dc38dc_cryptolocker.exe	91
PID 3076 wrote to memory of 3940	3076	2024-04-24_589050ff71796e627ad29a8978dc38dc_cryptolocker.exe	91
PID 3076 wrote to memory of 3940	3076	2024-04-24_589050ff71796e627ad29a8978dc38dc_cryptolocker.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-04-24_589050ff71796e627ad29a8978dc38dc_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-04-24_589050ff71796e627ad29a8978dc38dc_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\retln.exe
  "C:\Users\Admin\AppData\Local\Temp\retln.exe"
  2⤵
  - Executes dropped EXE
  PID:3940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3912 --field-trial-handle=2248,i,10247514684337323751,15511974759131734137,262144 --variations-seed-version /prefetch:8
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
42KB

MD5
cb9e7c8bdea959d736614e41a2f7221a

SHA1
4e868ec72befbd4853e5160b246b1147f400b393

SHA256
ded354c62804d4ef1054b86c0d6dc0efa1924baf4df86c17d72e07c55ca188fc

SHA512
3997ba95de603ac88c58dea606a7db3fc2dd0c5f2037e2fd1e6a361209e4a40e17dcf4f178e0ae76dabdef1690278edf405541760e8e883f4b6e3d40120f8592

Download Submit
memory/3076-0-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/3076-1-0x00000000022D0000-0x00000000022D6000-memory.dmp

Filesize
24KB

Download
memory/3076-2-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3940-21-0x00000000005F0000-0x00000000005F6000-memory.dmp

Filesize
24KB

Download