332a9f9e03fc8bcd5b0fff937505097b5e19974c326424dad7a27e0090976541

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe
Size

44KB
MD5

704f3898b15f5fd082547d5463d30956
SHA1

5be1cc9361dd32b2ba4fefcd80d0c90993777437
SHA256

332a9f9e03fc8bcd5b0fff937505097b5e19974c326424dad7a27e0090976541
SHA512

72fc74a989a1b9512cb59efb011fba93e95257ef08c9f2cab3d78af7f396ab5e2e4b5edb9c23396b3dd3cfa18faaf835ae9b396ad0d5d88fae779b550b1186b1
SSDEEP

768:b/yC4GyNM01GuQMNXw2PSjHPbSuYlW8PA4DwOoJ8:b/pYayGig5HjS3NPAuwfO

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

1556 retln.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
1556	retln.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe

description	pid	process	target process
PID 2052 wrote to memory of 1556	2052	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe	retln.exe
PID 2052 wrote to memory of 1556	2052	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe	retln.exe
PID 2052 wrote to memory of 1556	2052	2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe	retln.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_704f3898b15f5fd082547d5463d30956_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:2052

C:\Users\Admin\AppData\Local\Temp\retln.exe
"C:\Users\Admin\AppData\Local\Temp\retln.exe"
2⤵
- Executes dropped EXE
PID:1556

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=2860,i,2607710392823067546,4648797561512801463,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe

Filesize
44KB

MD5
0fe61a2623d987d4e5b2378ac578d7d4

SHA1
3d2707629104ae721ba27b3928ccc08bd21f2688

SHA256
7f4a527e986250d7e83dd801e8d20eb6d476ad461c3f5aa5814d96ebb8d3f467

SHA512
b53a0d7d69c86c3c04dff3bb1a4f52461f8ac309abfcfb9c5d5d72fb306da2b4cd6108a994ddca4abe20b32a47b581ef8f2ffd568e03b2b660a250038051ecd3

Download Submit
memory/1556-25-0x0000000000600000-0x0000000000606000-memory.dmp

Filesize
24KB

Download
memory/2052-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2052-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2052-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download