cfcd632752fe2aa676446f054756ac8ec0dd8eef4e39c0a2b9f89a92ee071ca7

Analysis

max time kernel
150s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 02:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe
Size

31KB
MD5

caedafbafa077f5caabae3bbaf013590
SHA1

a95e238469efb754b806e66dd97c8632f6ad66b1
SHA256

cfcd632752fe2aa676446f054756ac8ec0dd8eef4e39c0a2b9f89a92ee071ca7
SHA512

c6927e85289605e122322308bbd4c54ec6ba156ef4bc52d59f91a8d501cb3971d813688c4550fe5cfb522fb07d99091c95cf4a311d55cd3a5670be7117f5d78d
SSDEEP

384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zznum+U8Ss87vhf:b/yC4GyNM01GuQMNXum+NSnf

Score

9^/10

Malware Config

Signatures

Detection of CryptoLocker Variants 1 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\retln.exe	CryptoLocker_rule2

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe

Executes dropped EXE 1 IoCs

Processes:

retln.exe

pid process

2524 retln.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2524	retln.exe

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe

description	pid	process	target process
PID 116 wrote to memory of 2524	116	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe	retln.exe
PID 116 wrote to memory of 2524	116	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe	retln.exe
PID 116 wrote to memory of 2524	116	2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe	retln.exe

C:\Users\Admin\AppData\Local\Temp\2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe
"C:\Users\Admin\AppData\Local\Temp\2024-05-22_caedafbafa077f5caabae3bbaf013590_cryptolocker.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:116

C:\Users\Admin\AppData\Local\Temp\retln.exe
"C:\Users\Admin\AppData\Local\Temp\retln.exe"
2⤵
- Executes dropped EXE
PID:2524

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\retln.exe
Filesize
31KB

MD5
041da58062a3faa214bb894bdc7ed98e

SHA1
ff28848bbceed9c298865a53be96db72c3aba043

SHA256
38061aad79974af892ec23243585af7243695ef3394a2d5874965d3864fcb6b2

SHA512
5c5dd1397be2a309e5e74952bec9783642e19538113f22163a0e038639b45ca77c8be87e187482c0a3a3ee752e863b4b1514e7738bc5394ca6ae00edfdaeed2d

Download Submit
memory/116-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/116-1-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/116-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

Filesize
24KB

Download
memory/2524-25-0x0000000002250000-0x0000000002256000-memory.dmp

Filesize
24KB

Download