Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27/05/2024, 18:46

General

  • Target

    2024-05-27_e86563b09645ddb7464fccb7d1fdd390_cryptolocker.exe

  • Size

    41KB

  • MD5

    e86563b09645ddb7464fccb7d1fdd390

  • SHA1

    b15c69755a89ef44e74e68642b7186fc1acb5629

  • SHA256

    aaaa3b43426637ca9cdc30e5066061264170cc93f5923d462addc1179877b7f0

  • SHA512

    66d767650022bcbb9e1f5dae2e0e8fcf4279ce78547a9bdde712f1e6000732393d5b6e94a5392abd738e7a0038769853e8948a4b6386bab78ad1de4158901faf

  • SSDEEP

    384:bM7Q0pjC4GybxMv01d3AcASBQMf6i/zzzcYgUPSznHzl6AJvDSuYlmoHR8uyv7:b/yC4GyNM01GuQMNXw2PSjHPbSuYlZ67

Score
9/10

Malware Config

Signatures

  • Detection of CryptoLocker Variants 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-05-27_e86563b09645ddb7464fccb7d1fdd390_cryptolocker.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-05-27_e86563b09645ddb7464fccb7d1fdd390_cryptolocker.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:4656
    • C:\Users\Admin\AppData\Local\Temp\retln.exe
      "C:\Users\Admin\AppData\Local\Temp\retln.exe"
      2⤵
      • Executes dropped EXE
      PID:1204

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\retln.exe

          Filesize

          41KB

          MD5

          5a18fe9daecdbaf09b182090a767e194

          SHA1

          4127c8c71f21f4f6152154197ba90bbfa5e94d4d

          SHA256

          ed687604ab929336f77a256df9a14a15aa59299fe14a17f67c334ba12cd5521a

          SHA512

          620a138b7873df0a90e90f9633a12b7daabe34d9d112b8afa1b70328f9b7460fd60fc50032a607f8cb37ebc09791f6d3d8464e3e552877df34a60f37a4355f8d

        • memory/1204-25-0x0000000002160000-0x0000000002166000-memory.dmp

          Filesize

          24KB

        • memory/4656-0-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

          Filesize

          24KB

        • memory/4656-1-0x0000000000400000-0x0000000000406000-memory.dmp

          Filesize

          24KB

        • memory/4656-8-0x0000000002EA0000-0x0000000002EA6000-memory.dmp

          Filesize

          24KB